Qué hace este MCP
Scans authorized web applications, reports vulnerabilities with evidence and fixes, verifies domains for active testing, and monitors sites for security and uptime issues.
Capacidades
Herramientas
12
herramientas
add_monitor
Monitor a site
Put a site the user owns under continuous monitoring: hourly uptime checks, CVE matching, certificate alerts and regular rescans. Runs a full baseline scan straight away, which uses one of the user's scans exactly as in the app (free for plan holders). Returns the baseline scan_id for get_scan_status.
Acceso externo
Esquema de entrada
{'type': 'object', '$schema': 'http://json-schema.org/draft-07/schema#', 'required': ['url'], 'properties': {'url': {'type': 'string', 'maxLength': 2048, 'minLength': 1, 'description': 'The site to monitor, e.g. https://example.com'}}, 'additionalProperties': False}
check_domain_verification
Check a domain verification
Check whether the file or DNS record from start_domain_verification is live. On success the domain is verified and its next scan includes active tests. DNS changes can take a few minutes.
Acceso externo
Idempotente
Esquema de entrada
{'type': 'object', '$schema': 'http://json-schema.org/draft-07/schema#', 'required': ['domain'], 'properties': {'domain': {'type': 'string', 'maxLength': 253, 'minLength': 1, 'description': 'The domain passed to start_domain_verification'}}, 'additionalProperties': False}
dismiss_finding
Dismiss a false positive
Mark a finding as a false positive for this site, so future scans of it stop reporting it â the same as Dismiss in the app, and undoable there. ONLY use this after the user has confirmed the finding is wrong; never dismiss a real problem to improve a grade.
Destructivo
Esquema de entrada
{'type': 'object', '$schema': 'http://json-schema.org/draft-07/schema#', 'required': ['scan_id', 'finding_name'], 'properties': {'scan_id': {'type': 'string', 'description': 'The scan whose report contains the finding'}, 'finding_name': {'type': 'string', 'maxLength': 300, 'minLength': 1, 'description': "The finding's name exactly as get_report shows it"}}, 'additionalProperties': False}
get_account
Scans left and plan
How many scans the user can still run â free scans, plan scans and credits â and their plan. Check this before starting several scans.
Solo lectura
Esquema de entrada
{'type': 'object', '$schema': 'http://json-schema.org/draft-07/schema#', 'properties': {}}
get_report
Read a scan report
The finished report for a scan: grade, what the scan tested and what it skipped (a clean grade says nothing about skipped areas, so say so), prioritised findings with fixes and evidence, and a fix prompt written for the user's AI editor. Findings come 25 per page, most severe first â pass offset for the next page, or min_severity (e.g. "high") to focus on what matters most.
Solo lectura
Esquema de entrada
{'type': 'object', '$schema': 'http://json-schema.org/draft-07/schema#', 'required': ['scan_id'], 'properties': {'limit': {'type': 'integer', 'maximum': 50, 'minimum': 1, 'description': 'Findings per page (default 25, max 50)'}, 'offset': {'type': 'integer', 'minimum': 0, 'description': 'Skip this many findings, for the next page'}, 'scan_id': {'type': 'string', 'description': 'The scan_id returned by scan_url or list_recent_scans'}, 'min_severity': {'enum': ['critical', 'high', 'medium', 'low', 'info'], 'type': 'string', 'description': 'Only findings at this severity or worse, e.g. "high"'}}, 'additionalProperties': False}
get_scan_status
Check a scan
Status of a scan (queued, scanning, analyzing, complete, failed). With wait_seconds (max 60) it waits for the scan to finish and returns the full report as soon as it does.
Solo lectura
Esquema de entrada
{'type': 'object', '$schema': 'http://json-schema.org/draft-07/schema#', 'required': ['scan_id'], 'properties': {'scan_id': {'type': 'string', 'description': 'The scan_id returned by scan_url'}, 'wait_seconds': {'type': 'integer', 'maximum': 60, 'minimum': 0, 'description': 'Wait up to this long for the scan to finish'}}, 'additionalProperties': False}
list_monitors
List monitored sites
Sites under continuous monitoring: latest grade, last and next scan, uptime check, CVE alerts, new problems in the last scan and certificate expiry. Use the monitor id with monitor_scan_now.
Solo lectura
Esquema de entrada
{'type': 'object', '$schema': 'http://json-schema.org/draft-07/schema#', 'properties': {}}
list_recent_scans
List recent scans
The user's most recent scans with their status, newest first.
Solo lectura
Esquema de entrada
{'type': 'object', '$schema': 'http://json-schema.org/draft-07/schema#', 'properties': {'limit': {'type': 'integer', 'maximum': 25, 'minimum': 1}}, 'additionalProperties': False}
list_verified_domains
List verified domains
Domains the user has proved they own. Only these receive active testing (injection, XSS, SSRF, access control); others get passive checks. Verify more at https://secscan.us/domains.
Solo lectura
Esquema de entrada
{'type': 'object', '$schema': 'http://json-schema.org/draft-07/schema#', 'properties': {}}
monitor_scan_now
Rescan a monitored site now
Run a full scan of a monitored site now instead of waiting for its schedule â e.g. to confirm a fix. Free for plan holders; otherwise uses one of the user's scans, as in the app. Takes the monitor id from list_monitors.
Acceso externo
Esquema de entrada
{'type': 'object', '$schema': 'http://json-schema.org/draft-07/schema#', 'required': ['monitor_id'], 'properties': {'monitor_id': {'type': 'string', 'description': 'The monitor id from list_monitors or add_monitor'}}, 'additionalProperties': False}
scan_url
Scan a website
Start a SecScan security scan of a web application the user owns or is authorised to test. Returns a scan_id; most scans finish in under a minute â then call get_scan_status with wait_seconds, or get_report. Active tests (injection, XSS, SSRFâ¦) run only on domains the user has verified; others get passive checks. Optionally also reads a public GitHub repository for committed secrets (github_repo); that only contacts GitHub, never the site. Each scan uses one of the user's free scans, plan scans or credits.
Acceso externo
Esquema de entrada
{'type': 'object', '$schema': 'http://json-schema.org/draft-07/schema#', 'required': ['url'], 'properties': {'url': {'type': 'string', 'maxLength': 2048, 'minLength': 1, 'description': 'The URL to scan, e.g. https://example.com'}, 'github_repo': {'type': 'string', 'maxLength': 300, 'description': 'Optional public GitHub repository to check for committed secrets, e.g. https://github.com/owner/repo. Public repositories only.'}}, 'additionalProperties': False}
start_domain_verification
Start verifying a domain
Begin proving the user owns a domain, which unlocks active tests (injection, XSS, SSRF, access control) on its scans. Returns a file to publish on the site, or a DNS TXT record â an editor can usually add the file to the codebase and deploy it. Then call check_domain_verification. Calling it again returns the same token, so a record already published stays valid.
Esquema de entrada
{'type': 'object', '$schema': 'http://json-schema.org/draft-07/schema#', 'required': ['domain'], 'properties': {'domain': {'type': 'string', 'maxLength': 253, 'minLength': 1, 'description': 'The domain, e.g. example.com or https://example.com'}}, 'additionalProperties': False}
Historial
Cambios recientes en herramientas
Modificado
scan_url
2 de October de 2026 a las 02:41
Añadido
dismiss_finding
28 de September de 2026 a las 02:40
Añadido
monitor_scan_now
28 de September de 2026 a las 02:40
Añadido
add_monitor
28 de September de 2026 a las 02:40
Añadido
list_monitors
28 de September de 2026 a las 02:40
Añadido
check_domain_verification
28 de September de 2026 a las 02:40
Añadido
start_domain_verification
28 de September de 2026 a las 02:40
Añadido
get_account
28 de September de 2026 a las 02:40
Añadido
list_verified_domains
28 de September de 2026 a las 02:40
Añadido
list_recent_scans
28 de September de 2026 a las 02:40
Añadido
get_report
28 de September de 2026 a las 02:40
Añadido
get_scan_status
28 de September de 2026 a las 02:40
Añadido
scan_url
28 de September de 2026 a las 02:40
Descubrir
Servidores MCP similares
osint-terminal
com.thetempleofdoom.osint-mcp/osint-terminal
Provides keyless OSINT and reconnaissance tools for domains, DNS, IPs, breach exposure, threat intelligence, and related lookups.
AIMEAT
io.aimeat/aimeat
Provides a self-hosted agent operating system with agent work delegation, access controls, federation, hooks, SSO, security admin…
hyperion
com.thetempleofdoom.hyperion/hyperion
Acts as a paid MCP tool marketplace and utility gateway with server discovery, HTTP and JavaScript tools, research, data conversi…
Vee3
io.github.Vee3io/vee3
Manages Clerk authentication infrastructure, including users, organizations, domains, sessions, tokens, OAuth, SSO, machines, per…
BorealHost
ai.borealhost/mcp
Provides web hosting and infrastructure management, including site deployment, DNS, domains, containers, compute, backups, cachin…
Proof Holdings
holdings.proof/mcp-server
Provides domain verification, identity and delegation proofs, human approval workflows, trusted-contact challenges, and controlle…
GoCreative Agent API
io.github.ColinHughes2121/gocreative-agent-api
Offers pay-per-call LLM completions and data services for company intelligence, KYB, sanctions screening, threat intelligence, co…
Japan Public Ledgers MCP
com.mcp-revenue-empire/japan-public-ledgers
Provides agent identity, memory, audit, trust, proxy, temporary email, webhook, CAPTCHA, and alerting capabilities alongside publ…