Connect ScanLabsAI Security Scanner and your agent gets 8 tools, among them buy_credits, check_credits, compliance_report. It answers at https://scanlabsai.com/api/mcp over streamable HTTP, and it listed its tools to an anonymous client, so no sign-in was needed for that. Our probes reached it 10 of 10 times since 5 September 2026; the last check, on 18 October 2026, succeeded.
Scan a website for vulnerabilities: OWASP Top 10, CVEs, SSL, headers - with plain-English fixes
Description as the publisher wrote it.
| Tool | What it does |
|---|---|
buy_credits | Get a secure Stripe checkout link to buy an AI credit pack for the signed-in account. Requires a ScanLabsAI API key in the MCP connection. Credits are added automatically once payment completes. Packs: starter (5), pro (15), agency (50). Inputs: pack |
check_credits | Check the signed-in account's AI credit balance. Requires a ScanLabsAI API key in the MCP connection (Authorization: Bearer slai_...). Create one at https://scanlabsai.com/mcp. |
compliance_report | Generate a website compliance report — the same automated assessment the ScanLabsAI agency portal runs — covering GDPR/CCPA privacy, WCAG 2.1 AA accessibility, PCI DSS 4.0 payment security and general standards. Returns an overall score, pe Inputs: url |
get_fix_guidance | Get detailed, step-by-step remediation guidance for a specific vulnerability or security issue (e.g. "missing Content-Security-Policy header", "SQL injection", a CVE id). Returns actionable fixes. Inputs: issue |
get_pricing | Get ScanLabsAI pricing: the free-first-scan policy and AI credit packs. |
lookup_cves | Look up recent CVEs from the NIST NVD feed, optionally filtered by keyword. Returns id, severity, score and summary. Inputs: keyword, limit |
scan_agent | Red-team an AI agent for security weaknesses — prompt injection, system-prompt leakage, sensitive-data disclosure, unsafe output handling and excessive agency — mapped to the OWASP LLM Top 10, and return a Markdown report. This is agent-to- Inputs: kind, endpoint, apiKey, model, deep |
scan_website | Run a ScanLabsAI security scan against a website and return a full Markdown vulnerability report (grouped by severity, with descriptions and remediation) that you can analyse, act on, and the user can save as security-report.md. Checks OWAS Inputs: url, deep |
Every block below points at https://scanlabsai.com/api/mcp. Pick your client and copy.
claude mcp add --transport http scanlabsai-security-scanner https://scanlabsai.com/api/mcp
{
"mcpServers": {
"scanlabsai-security-scanner": {
"command": "npx",
"args": ["-y", "mcp-remote", "https://scanlabsai.com/api/mcp"]
}
}
}{
"mcpServers": {
"scanlabsai-security-scanner": {
"url": "https://scanlabsai.com/api/mcp"
}
}
}{
"servers": {
"scanlabsai-security-scanner": {
"type": "http",
"url": "https://scanlabsai.com/api/mcp"
}
}
}{
"context_servers": {
"scanlabsai-security-scanner": {
"url": "https://scanlabsai.com/api/mcp"
}
}
}{
"mcpServers": {
"scanlabsai-security-scanner": {
"serverUrl": "https://scanlabsai.com/api/mcp"
}
}
}{
"mcpServers": {
"scanlabsai-security-scanner": {
"url": "https://scanlabsai.com/api/mcp"
}
}
}name: ScanLabsAI Security Scanner
version: 0.0.1
schema: v1
mcpServers:
- name: ScanLabsAI Security Scanner
type: streamable-http
url: https://scanlabsai.com/api/mcp{
"mcpServers": {
"scanlabsai-security-scanner": {
"httpUrl": "https://scanlabsai.com/api/mcp"
}
}
}{
"mcpServers": {
"scanlabsai-security-scanner": {
"type": "http",
"url": "https://scanlabsai.com/api/mcp"
}
}
}{
"mcpServers": {
"scanlabsai-security-scanner": {
"url": "https://scanlabsai.com/api/mcp"
}
}
}goose://extension?url=https%3A%2F%2Fscanlabsai.com%2Fapi%2Fmcp&type=streamable_http&id=scanlabsai-security-scanner&name=ScanLabsAI%20Security%20Scanner
It answered our last check on 18 October 2026 in 248 ms. Over 10 checks since 5 September 2026 it answered 10. Status here comes from Neuronto's own probes, not from the publisher.
Yes. It is published by scanlabsai.com and served from scanlabsai.com, the vendor's own domain: https://scanlabsai.com/api/mcp.
8, as returned by the server's own tools/list on 31 August 2026: buy_credits, check_credits, compliance_report, get_fix_guidance, get_pricing, lookup_cves, scan_agent, scan_website.
It answered our last check on 18 October 2026 in 248 ms. Over 10 checks since 5 September 2026 it answered 10.
Put the server under mcpServers in ~/.cursor/mcp.json with the URL https://scanlabsai.com/api/mcp. The exact JSON is above, with the same setup for Claude Code, Claude Desktop, VS Code, Windsurf, Zed, Gemini CLI and the rest.
It listed its tools to an anonymous client, so reading the tool list needs no key. Individual tools can still ask for credentials in their own inputs.
Publisher: com.scanlabsai. Endpoint host: scanlabsai.com. ARD identifier: urn:air:com.scanlabsai:mcp:scanner.
First indexed 31 August 2026. The tools are exactly what the server returned; nothing on this page
is inferred from its name. Ranking in Neuronto search is never for sale.