SecScan is answering right now. Last checked moments ago. It exposes 12 tools.
Scan, monitor and fix a live web app from your editor: graded security reports with fix prompts.
Uptime history
19 days of history · worst day 93%
19 days agonow
100.0%
Uptime 24h
92 of 92 checks
12
Tools
read from the server
548 ms
Response time
average over 24h
open, no key
Access
streamable-http
SecScan missed one check this week
Everything else answered, so this is steady rather than shaky. We check every 15 minutes, which is how a one-off gets told apart from the start of a pattern, and how you hear about the next one within the hour instead of from your users.
Connect this server
Endpoint below is the one we actually reach during checks — not the one copied from a README. Last verified 0 min ago.
run in your terminal
claude mcp add secscan --transport http https://secscan.us/api/mcp~/Library/Application Support/Claude/claude_desktop_config.json
{
"mcpServers": {
"secscan": {
"url": "https://secscan.us/api/mcp"
}
}
}~/.codex/config.toml
[mcp_servers.secscan]
url = "https://secscan.us/api/mcp".cursor/mcp.json
{
"mcpServers": {
"secscan": {
"url": "https://secscan.us/api/mcp"
}
}
}.vscode/mcp.json
{
"mcpServers": {
"secscan": {
"url": "https://secscan.us/api/mcp"
}
}
}Available tools 12
Read directly from the server with tools/list, grouped by what they act on.
If a tool disappears, we record the date.
monitor
add_monitor
Put a site the user owns under continuous monitoring: hourly uptime checks, CVE matching, certificate alerts and regular rescans. Runs a full baseline scan straight away, which uses one of the user's scans exactly as in the app (free for plan holders). Returns the baseline scan_id for get_scan_status.
monitor_scan_now
Run a full scan of a monitored site now instead of waiting for its schedule — e.g. to confirm a fix. Free for plan holders; otherwise uses one of the user's scans, as in the app. Takes the monitor id from list_monitors.
scan
get_scan_status
Status of a scan (queued, scanning, analyzing, complete, failed). With wait_seconds (max 60) it waits for the scan to finish and returns the full report as soon as it does.
scan_url
Start a SecScan security scan of a web application the user owns or is authorised to test. Returns a scan_id; most scans finish in under a minute — then call get_scan_status with wait_seconds, or get_report. Active tests (injection, XSS, SSRF…) run only on domains the user has verified; others get passive checks. Optionally also reads a public GitHub repository for committed secrets (github_repo); that only contacts GitHub, never the site. Each scan uses one of the user's free scans, plan scans or credits.
account
get_account
How many scans the user can still run — free scans, plan scans and credits — and their plan. Check this before starting several scans.
dismiss
dismiss_finding
Mark a finding as a false positive for this site, so future scans of it stop reporting it — the same as Dismiss in the app, and undoable there. ONLY use this after the user has confirmed the finding is wrong; never dismiss a real problem to improve a grade.
domain
check_domain_verification
Check whether the file or DNS record from start_domain_verification is live. On success the domain is verified and its next scan includes active tests. DNS changes can take a few minutes.
monitors
list_monitors
Sites under continuous monitoring: latest grade, last and next scan, uptime check, CVE alerts, new problems in the last scan and certificate expiry. Use the monitor id with monitor_scan_now.
recent
list_recent_scans
The user's most recent scans with their status, newest first.
report
get_report
The finished report for a scan: grade, what the scan tested and what it skipped (a clean grade says nothing about skipped areas, so say so), prioritised findings with fixes and evidence, and a fix prompt written for the user's AI editor. Findings come 25 per page, most severe first — pass offset for the next page, or min_severity (e.g. "high") to focus on what matters most.
start
start_domain_verification
Begin proving the user owns a domain, which unlocks active tests (injection, XSS, SSRF, access control) on its scans. Returns a file to publish on the site, or a DNS TXT record — an editor can usually add the file to the codebase and deploy it. Then call check_domain_verification. Calling it again returns the same token, so a record already published stays valid.
verified
list_verified_domains
Domains the user has proved they own. Only these receive active testing (injection, XSS, SSRF, access control); others get passive checks. Verify more at https://secscan.us/domains.
Endpoints
| URL | Transport | State | Latency | Checked |
|---|---|---|---|---|
| https://secscan.us/api/mcp | streamable-http | answering | 1297 ms | 0 min ago |
Alternatives to SecScan
same job, measured the same wayTrent
by trent
Security reviews, threat models over a repo or website, and remediation tracking, in your editor.
AdAce Ads
by adace
Google Ads and Meta Ads from Claude or ChatGPT: live reports, wasted spend, changes you approve.
lavela
by ym2629
Deploy a repo to a live app from chat: servers, Postgres, domain, email, Stripe, security scan.
Jikida
by jikida
Security tools for your AI: scan, pentest, check headers, guard code and scan repos for secrets.
MCP ZAP Server
by dtkmn
Safe, self-hosted ZAP operator for guided AI security scans and reports.
AppWizzy Projects
by appwizzy
Create and monitor AppWizzy app environments from GitHub or ZIP with AI agents.
Bellwether MCP
by bellwethermetrics
Live prediction market data from Polymarket and Kalshi with VWAP pricing and reportability.
ProjectPulse MCP
by alexbypa
Monitor GitHub repo health, DORA metrics and CI signals from your AI assistant.
SecScan — questions
Answers built from our own checks of this server.
What can SecScan do?
It exposes 12 tools, read directly from the server on our last check. Among them: add_monitor, check_domain_verification, dismiss_finding, get_account, get_report, get_scan_status and 6 more. The full list with descriptions is on this page — we take it from the server itself via tools/list, not from a README.
How MCP servers expose tools in the first place →
What is SecScan mostly used for?
Its tools cluster around monitor and scan. That is what this server is built to work with — the grouping comes from the actual tool names, not from a category we assigned.
Is SecScan working right now?
We send a real MCP handshake every 15 minutes. Over the last 24 hours 92 of 92 checks got a reply (100.0%), average response time 548 ms. The bar chart above shows every period we have measured.
How do I connect SecScan?
Copy the ready config from this page — we generate it for Claude Code, Claude Desktop, Codex, Cursor and VS Code, each with the file path that client actually reads. It is a remote server, so there is nothing to install — the client connects to the address.
Does SecScan need an API key?
No. SecScan completed a full MCP handshake with us as an anonymous client and listed its tools without asking for anything. All 12 of them are readable on this page. This is what we observed, not what the docs claim.
How fast is SecScan?
It answers our handshake in 548 ms on average, which is faster than 22% of all working MCP servers we measure. That is on the slow side — worth knowing if the tool sits inside an interactive loop. The comparison comes from our own checks across the whole registry, every 15 minutes.