SecScan is a remote MCP server that gives an AI agent 12 tools, among them add_monitor, check_domain_verification, dismiss_finding. It answers at https://secscan.us/api/mcp over streamable HTTP, and it listed its tools to an anonymous client, so no sign-in was needed for that. Our probes reached it 4 of 4 times since 23 September 2026; the last check, on 7 November 2026, succeeded.
Scan, monitor and fix a live web app from your editor: graded security reports with fix prompts.
Description as the publisher wrote it.
| Tool | What it does |
|---|---|
add_monitor | Put a site the user owns under continuous monitoring: hourly uptime checks, CVE matching, certificate alerts and regular rescans. Runs a full baseline scan straight away, which uses one of the user's scans exactly as in the app (free for pl Inputs: url |
check_domain_verification | Check whether the file or DNS record from start_domain_verification is live. On success the domain is verified and its next scan includes active tests. DNS changes can take a few minutes. Inputs: domain |
dismiss_finding | Mark a finding as a false positive for this site, so future scans of it stop reporting it — the same as Dismiss in the app, and undoable there. ONLY use this after the user has confirmed the finding is wrong; never dismiss a real problem to Inputs: scan_id, finding_name |
get_account | How many scans the user can still run — free scans, plan scans and credits — and their plan. Check this before starting several scans. |
get_report | The finished report for a scan: grade, what the scan tested and what it skipped (a clean grade says nothing about skipped areas, so say so), prioritised findings with fixes and evidence, and a fix prompt written for the user's AI editor. Fi Inputs: scan_id, min_severity, offset, limit |
get_scan_status | Status of a scan (queued, scanning, analyzing, complete, failed). With wait_seconds (max 60) it waits for the scan to finish and returns the full report as soon as it does. Inputs: scan_id, wait_seconds |
list_monitors | Sites under continuous monitoring: latest grade, last and next scan, uptime check, CVE alerts, new problems in the last scan and certificate expiry. Use the monitor id with monitor_scan_now. |
list_recent_scans | The user's most recent scans with their status, newest first. Inputs: limit |
list_verified_domains | Domains the user has proved they own. Only these receive active testing (injection, XSS, SSRF, access control); others get passive checks. Verify more at https://secscan.us/domains. |
monitor_scan_now | Run a full scan of a monitored site now instead of waiting for its schedule — e.g. to confirm a fix. Free for plan holders; otherwise uses one of the user's scans, as in the app. Takes the monitor id from list_monitors. Inputs: monitor_id |
scan_url | Start a SecScan security scan of a web application the user owns or is authorised to test. Returns a scan_id; most scans finish in under a minute — then call get_scan_status with wait_seconds, or get_report. Active tests (injection, XSS, SS Inputs: url, github_repo |
start_domain_verification | Begin proving the user owns a domain, which unlocks active tests (injection, XSS, SSRF, access control) on its scans. Returns a file to publish on the site, or a DNS TXT record — an editor can usually add the file to the codebase and deploy Inputs: domain |
Every block below points at https://secscan.us/api/mcp. Pick your client and copy.
claude mcp add --transport http secscan https://secscan.us/api/mcp
{
"mcpServers": {
"secscan": {
"command": "npx",
"args": ["-y", "mcp-remote", "https://secscan.us/api/mcp"]
}
}
}{
"mcpServers": {
"secscan": {
"url": "https://secscan.us/api/mcp"
}
}
}{
"servers": {
"secscan": {
"type": "http",
"url": "https://secscan.us/api/mcp"
}
}
}{
"context_servers": {
"secscan": {
"url": "https://secscan.us/api/mcp"
}
}
}{
"mcpServers": {
"secscan": {
"serverUrl": "https://secscan.us/api/mcp"
}
}
}{
"mcpServers": {
"secscan": {
"url": "https://secscan.us/api/mcp"
}
}
}name: SecScan
version: 0.0.1
schema: v1
mcpServers:
- name: SecScan
type: streamable-http
url: https://secscan.us/api/mcp{
"mcpServers": {
"secscan": {
"httpUrl": "https://secscan.us/api/mcp"
}
}
}{
"mcpServers": {
"secscan": {
"type": "http",
"url": "https://secscan.us/api/mcp"
}
}
}{
"mcpServers": {
"secscan": {
"url": "https://secscan.us/api/mcp"
}
}
}goose://extension?url=https%3A%2F%2Fsecscan.us%2Fapi%2Fmcp&type=streamable_http&id=secscan&name=SecScan
It answered our last check on 7 November 2026 in 257 ms. Over 4 checks since 23 September 2026 it answered 4. Status here comes from Neuronto's own probes, not from the publisher.
Yes. It is published by secscan.us and served from secscan.us, the vendor's own domain: https://secscan.us/api/mcp.
12, as returned by the server's own tools/list on 14 November 2026: add_monitor, check_domain_verification, dismiss_finding, get_account, get_report, get_scan_status, list_monitors, list_recent_scans, and 4 more.
It answered our last check on 7 November 2026 in 257 ms. Over 4 checks since 23 September 2026 it answered 4.
Put the server under mcpServers in ~/.cursor/mcp.json with the URL https://secscan.us/api/mcp. The exact JSON is above, with the same setup for Claude Code, Claude Desktop, VS Code, Windsurf, Zed, Gemini CLI and the rest.
It listed its tools to an anonymous client, so reading the tool list needs no key. Individual tools can still ask for credentials in their own inputs.
Publisher: us.secscan. Endpoint host: secscan.us. ARD identifier: urn:air:us.secscan:mcp:secscan.
First indexed 23 September 2026. The tools are exactly what the server returned; nothing on this page
is inferred from its name. Ranking in Neuronto search is never for sale.