English Français العربية

SecurityScan

Official registry Developer tools

Scan GitHub-hosted AI skills for vulnerabilities: prompt injection, malware, OWASP LLM Top 10.

Source code Website

Install

Add this to your client's MCP configuration (Claude Desktop: claude_desktop_config.json; Cursor: .cursor/mcp.json; VS Code and others use the same "mcpServers" shape).

Remote (streamable-http)
Claude Code 
claude mcp add --transport http securityscan 'https://apisecurityscan.net/mcp' --header 'X-API-Key: <SecurityScan API key (ss_live_...). Register free at https://apisecurityscan.net/auth/register — no payment needed for FREE tier (5 scans/month).>'
JSON configuration (Claude Desktop, Cursor, VS Code) 
{
    "mcpServers": {
        "securityscan": {
            "type": "http",
            "url": "https://apisecurityscan.net/mcp",
            "headers": {
                "X-API-Key": "<SecurityScan API key (ss_live_...). Register free at https://apisecurityscan.net/auth/register — no payment needed for FREE tier (5 scans/month).>"
            }
        }
    }
}

Frequently asked questions

What is SecurityScan?

Scan GitHub-hosted AI skills for vulnerabilities: prompt injection, malware, OWASP LLM Top 10.

How do I install SecurityScan?

It runs as a remote server. In Claude Code: claude mcp add --transport http securityscan 'https://apisecurityscan.net/mcp' --header 'X-API-Key: <SecurityScan API key (ss_live_...). Register free at https://apisecurityscan.net/auth/register — no payment needed for FREE tier (5 scans/month).>'. For other clients, paste the JSON configuration from this page into their MCP settings.

Does SecurityScan need an API key?

Yes. It expects X-API-Key, which you set in its configuration.

Is SecurityScan open source?

Its code is public on GitHub, but the repository does not declare a standard license.

Who maintains SecurityScan?

It is published by securityscan-api. AI.tn lists it but does not maintain or endorse it.

From the official MCP Registry. Listing is not an endorsement: review a server's code and permissions before giving it access to your data.