SecScan

Install

Works with Claude Code, VS Code, Cursor, Windsurf. Read the repository before you give any tool access to your data.

npx agentmarket install connector/secscan-us-secscan

About

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this server can do and what it asks for, from its tool list and install config. Checked Oct 25, 2026.

Tools

7 read · 2 write · 1 delete · 2 not yet classified

Secrets

1 (API keys, tokens or passwords)

Install scripts

Nothing to install (hosted)

Runs as

Hosted (remote endpoint)

Tools (12)

As the server listed them on Oct 25, 2026. Descriptions are the server’s own words; hidden characters are shown as [U+…].

• add_monitorMonitor a site

  Put a site the user owns under continuous monitoring: hourly uptime checks, CVE matching, certificate alerts and regular rescans. Runs a full baseline scan straight away, which uses one of the user's scans exactly as in the app (free for plan holders). Returns the baseline scan_id for get_scan_status.

• check_domain_verificationCheck a domain verification

  Check whether the file or DNS record from start_domain_verification is live. On success the domain is verified and its next scan includes active tests. DNS changes can take a few minutes.

• dismiss_findingDismiss a false positivecan change or delete data

  Mark a finding as a false positive for this site, so future scans of it stop reporting it — the same as Dismiss in the app, and undoable there. ONLY use this after the user has confirmed the finding is wrong; never dismiss a real problem to improve a grade.

• get_accountScans left and planread-only

  How many scans the user can still run — free scans, plan scans and credits — and their plan. Check this before starting several scans.

• get_reportRead a scan reportread-only

  The finished report for a scan: grade, what the scan tested and what it skipped (a clean grade says nothing about skipped areas, so say so), prioritised findings with fixes and evidence, and a fix prompt written for the user's AI editor. Findings come 25 per page, most severe first — pass offset for the next page, or min_severity (e.g. "high") to focus on what matters most.

• get_scan_statusCheck a scanread-only

  Status of a scan (queued, scanning, analyzing, complete, failed). With wait_seconds (max 60) it waits for the scan to finish and returns the full report as soon as it does.

• list_monitorsList monitored sitesread-only

  Sites under continuous monitoring: latest grade, last and next scan, uptime check, CVE alerts, new problems in the last scan and certificate expiry. Use the monitor id with monitor_scan_now.

• list_recent_scansList recent scansread-only

  The user's most recent scans with their status, newest first.

• list_verified_domainsList verified domainsread-only

  Domains the user has proved they own. Only these receive active testing (injection, XSS, SSRF, access control); others get passive checks. Verify more at https://secscan.us/domains.

• monitor_scan_nowRescan a monitored site now

  Run a full scan of a monitored site now instead of waiting for its schedule — e.g. to confirm a fix. Free for plan holders; otherwise uses one of the user's scans, as in the app. Takes the monitor id from list_monitors.

• scan_urlScan a website

  Start a SecScan security scan of a web application the user owns or is authorised to test. Returns a scan_id; most scans finish in under a minute — then call get_scan_status with wait_seconds, or get_report. Active tests (injection, XSS, SSRF…) run only on domains the user has verified; others get passive checks. Optionally also reads a GitHub repository's source (github_repo): any public one, or a private one the user connected at secscan.us. That only contacts GitHub, never the site. Each scan uses one of the user's free scans, plan scans or credits.

• start_domain_verificationStart verifying a domain

  Begin proving the user owns a domain, which unlocks active tests (injection, XSS, SSRF, access control) on its scans. Returns a file to publish on the site, or a DNS TXT record — an editor can usually add the file to the codebase and deploy it. Then call check_domain_verification. Calling it again returns the same token, so a record already published stays valid.

Signals

Last release

Sep 23, 2026 (1 month ago)

Details

Registry name

us.secscan/secscan

Version

1.1.0

Auth

Bearer token

License

License unknown

Website

secscan.info/ai-editors

First seen

Oct 24, 2026

Last checked

Oct 24, 2026

Source

Official MCP Registry