Skip to content

SimplyScan

by simplyscan.io · remote · no sign-in to list tools · v1.0.0 · published by io.simplyscan

Security, SEO and AI-visibility scanner for web apps · free scans and focused checks via MCP.

Final · 1Changes · 61 high finding
CompareRegistry entry

8 tools: 1 do something that can't be undone, 6 change things and 1 only read.

Scanned Oct 21, 2026

1 check matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http simplyscan https://api.simplyscan.io/mcp

Findings

Matches of fixed checks, with the text they matched.

1 high

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

8 tools

Can't be undone 1Claude Code: ask
  • scan_local_codeSend selected editor file contents to the SimplyScan Security Engine's deterministic repository rules.No findings

    Why it is in this group

    • The description's first verb is "send": a word for sending, and what is sent cannot be taken back.
    Description, as the server wrote it
    Send selected editor file contents to the SimplyScan Security Engine's deterministic repository rules. Requires a Pro API key. Source leaves the editor, is processed in memory, and is not retained; masked findings are saved in the private scan record. No AI provider receives these files. Code rules analyse JavaScript and TypeScript; other files are checked for secrets only. When no file can be analysed, the result has no score.

    Annotations the server declares

    • readOnlyHint: false
    • openWorldHint: false
Changes things 6Claude Code: ask
  • check_ai_visibilityAEO check: whether AI answer engines (ChatGPT/GPTBot, Claude, Perplexity, Google-Extended, etc.) can crawl and cite the site, plus llms.txt and structured-data signals.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    AEO check: whether AI answer engines (ChatGPT/GPTBot, Claude, Perplexity, Google-Extended, etc.) can crawl and cite the site, plus llms.txt and structured-data signals.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • check_email_securityCheck a domain's email authentication: SPF, DKIM (common selectors), and DMARC policy.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Check a domain's email authentication: SPF, DKIM (common selectors), and DMARC policy. Flags spoofable domains.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • check_exposed_filesProbe a site for accidentally exposed high-risk files (.env, .git/config, backups, etc.).1 finding

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • High

      The description refers to ".env".

      Matched text

      description: "...r accidentally exposed high-risk files (.env, .git/config, backups, etc.). Reports H..."

      What this check looks for
    Description, as the server wrote it
    Probe a site for accidentally exposed high-risk files (.env, .git/config, backups, etc.). Reports HTTP status only, never file contents.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • check_security_headersGrade a URL's HTTP security headers (CSP, HSTS, X-Frame-Options, Referrer-Policy, Permissions-Policy, COOP, COEP) A-F.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Grade a URL's HTTP security headers (CSP, HSTS, X-Frame-Options, Referrer-Policy, Permissions-Policy, COOP, COEP) A-F.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • check_seoOn-page SEO audit of a URL: title, meta description, H1, canonical, indexability, Open Graph, structured data, image alt coverage, sitemap.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    On-page SEO audit of a URL: title, meta description, H1, canonical, indexability, Open Graph, structured data, image alt coverage, sitemap. Returns an A-F grade.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • scan_websiteRun a SimplyScan Security Engine security & speed scan (Pro with an entitled API key; otherwise free) of a deployed web app URL.No findings

    Why it is in this group

    • The description's first verb is "run": a word for a change.
    Description, as the server wrote it
    Run a SimplyScan Security Engine security & speed scan (Pro with an entitled API key; otherwise free) of a deployed web app URL. Returns a 0-100 score and findings (exposed secrets, missing Supabase RLS, frontend leaks, speed issues). Best for apps built with Lovable, Bolt, v0, Cursor, Replit, etc.

    Annotations the server declares

    • readOnlyHint: false
    • openWorldHint: true
Only reads 1Claude Code: allow
  • check_sslInspect a domain's SSL/TLS certificate: issuer, expiry, protocol, and flags for expiring/self-signed/mismatched certs.No findings

    Why it is in this group

    • The description's first verb is "inspect": a word for reading.
    Description, as the server wrote it
    Inspect a domain's SSL/TLS certificate: issuer, expiry, protocol, and flags for expiring/self-signed/mismatched certs.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http simplyscan https://api.simplyscan.io/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__simplyscan__check_ssl"
    ],
    "ask": [
      "mcp__simplyscan__scan_website",
      "mcp__simplyscan__scan_local_code",
      "mcp__simplyscan__check_security_headers",
      "mcp__simplyscan__check_ai_visibility",
      "mcp__simplyscan__check_seo",
      "mcp__simplyscan__check_email_security",
      "mcp__simplyscan__check_exposed_files"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as simplyscan. Review it before you use it.