Skip to content

SecurityScan

by apisecurityscan.net · remote · no sign-in to list tools · v1.0.0 · published by net.apisecurityscan

Scan GitHub-hosted AI skills for vulnerabilities: prompt injection, malware, OWASP LLM Top 10.

Changes · 71 high finding
CompareRegistry entry

8 tools: 7 change things and 1 only read.

Scanned Oct 21, 2026

3 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http securityscan https://apisecurityscan.net/mcp --header 'X-API-Key: <your-x-api-key>'

Findings

Matches of fixed checks, with the text they matched.

1 high2 info
  • Highaudit_mcp_server_config

    The input schema at properties.config_json.description refers to "claude_desktop_config.json" and ".mcp.json".

    Matched text

    inputSchema.properties.config_json.description: "...config file as a string (e.g. claude_desktop_config.json or .mcp.json). Paste the file..."

    What this check looks for
  • Infonetwork_scan

    The input schema at properties.scan_type.description mentions "credentials".

    Matched text

    inputSchema.properties.scan_type.description: "...ent loop), "deep" (~10min, full ports + credentials check)"

    What this check looks for
  • Infoaudit_mcp_server_config

    The description mentions "credentials".

    Matched text

    description: "...uctions in tool descriptions, hardcoded credentials, unpinned packages (rug-pull risk), ins..."

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

8 tools

Changes things 7Claude Code: ask
  • audit_mcp_server_configAudit an MCP client configuration for security risks — works offline, no external service required.2 findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    Findings

    • Info

      The description mentions "credentials".

      Matched text

      description: "...uctions in tool descriptions, hardcoded credentials, unpinned packages (rug-pull risk), ins..."

      What this check looks for
    • High

      The input schema at properties.config_json.description refers to "claude_desktop_config.json" and ".mcp.json".

      Matched text

      inputSchema.properties.config_json.description: "...config file as a string (e.g. claude_desktop_config.json or .mcp.json). Paste the file..."

      What this check looks for
    Description, as the server wrote it
    Audit an MCP client configuration for security risks — works offline, no external service required. Detects: tool poisoning, hidden/coercive instructions in tool descriptions, hardcoded credentials, unpinned packages (rug-pull risk), insecure transport, and toxic capability combinations (shell + network, file-read + network).
  • check_dependenciesCheck the health of your agent's external dependencies: uptime, SSL validity, blacklist status, and a trust score 0-100 (DepScan).No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Check the health of your agent's external dependencies: uptime, SSL validity, blacklist status, and a trust score 0-100 (DepScan).
  • full_stack_auditComplete security posture in one call: audits the MCP config, checks dependency health, analyzes an untrusted skill, scans the local network gateway, and scans any payload you're a…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Complete security posture in one call: audits the MCP config, checks dependency health, analyzes an untrusted skill, scans the local network gateway, and scans any payload you're about to send out for secrets/PII — then correlates everything into a single prioritized report. Pass only what you have; each section is skipped gracefully if its input or service is missing.
  • network_scanActive security scan of a device or host with an autonomous AI agent that decides which follow-up probes to run (ActiveScanner).1 finding

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    Findings

    • Info

      The input schema at properties.scan_type.description mentions "credentials".

      Matched text

      inputSchema.properties.scan_type.description: "...ent loop), "deep" (~10min, full ports + credentials check)"

      What this check looks for
    Description, as the server wrote it
    Active security scan of a device or host with an autonomous AI agent that decides which follow-up probes to run (ActiveScanner). Only scan targets you own or have permission to test.
  • scan_secretsScan a text payload (a prompt, an outbound API body, a file's contents) for secrets and PII BEFORE it leaves for an LLM or external API, and return a redacted copy.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Scan a text payload (a prompt, an outbound API body, a file's contents) for secrets and PII BEFORE it leaves for an LLM or external API, and return a redacted copy. Catches the #1 real-world agent incident: secrets/PII leaking into a model's context. WORKS OFFLINE with no API key — the detection runs in-process (pure regex + Luhn check, no network). If a SecretScan backend key IS configured, the scan is routed there instead (which also persists an audit record).
  • securityscan_checkoutStart a Stripe checkout to buy a SecurityScan tier (agent-native sales).No findings

    Why it is in this group

    • The name "securityscan_checkout" says "checkout": a word for a change.
    Description, as the server wrote it
    Start a Stripe checkout to buy a SecurityScan tier (agent-native sales). Returns a payment URL to hand to your user AND a PENDING API key that activates automatically once payment clears — no other setup step.
  • securityscan_pricingSecurityScan catalog: tiers, prices, quotas and the evidence behind the product — the fact sheet an agent needs to evaluate or recommend a purchase to its user.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    SecurityScan catalog: tiers, prices, quotas and the evidence behind the product — the fact sheet an agent needs to evaluate or recommend a purchase to its user. Fully offline, no API key required. Returns: JSON with the tier table (price / target slots / scan types), the pricing model, benchmark evidence, and how to buy.
Only reads 1Claude Code: allow
  • scan_skillAnalyze an AI agent skill for prompt injection, malware patterns, and OWASP LLM Top 10 issues BEFORE installing it (SecurityScan).No findings

    Why it is in this group

    • The description's first verb is "analyze": a word for reading.
    Description, as the server wrote it
    Analyze an AI agent skill for prompt injection, malware patterns, and OWASP LLM Top 10 issues BEFORE installing it (SecurityScan).

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http securityscan https://apisecurityscan.net/mcp --header 'X-API-Key: <your-x-api-key>'

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__securityscan__scan_skill"
    ],
    "ask": [
      "mcp__securityscan__check_dependencies",
      "mcp__securityscan__network_scan",
      "mcp__securityscan__audit_mcp_server_config",
      "mcp__securityscan__scan_secrets",
      "mcp__securityscan__full_stack_audit",
      "mcp__securityscan__securityscan_pricing",
      "mcp__securityscan__securityscan_checkout"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as securityscan. Review it before you use it.