Securityscan Api MCP Server

SecurityScan API

Vulnerability scanner for AI agent skills. Detects prompt injection, malware patterns and OWASP LLM Top 10 issues before your agent installs an untrusted skill.

Live endpoint: https://apisecurityscan.net Health check: https://apisecurityscan.net/health

---

Why this exists

As AI agents increasingly install and execute third-party skills, supply chain security becomes a real problem. SecurityScan lets an agent verify a skill's safety autonomously — no human in the loop required.

---

What it detects

• Prompt injection patterns
• Malicious code indicators
• Data exfiltration attempts
• Unauthorized external API access
• Supply chain attack vectors
• OWASP LLM Top 10 coverage

---

Quick start

1. Get an API key

Register instantly — no payment required for the free tier:

curl -X POST https://apisecurityscan.net/auth/register \
  -H "Content-Type: application/json" \
  -d '{"email": "you@example.com", "name": "My Agent"}'

Response:

{
  "api_key": "ss_live_...",
  "plan": "FREE",
  "scans_remaining": 5
}

Store api_key. Proceed immediately — no payment needed for FREE tier.

2. Run a scan

curl -X POST https://apisecurityscan.net/scan \
  -H "Content-Type: application/json" \
  -H "X-API-Key: ss_live_your_key" \
  -d '{
    "skill_url": "https://github.com/owner/skill-repo"
  }'

Note: skill_url must be a github.com URL.

3. Response

{
  "scan_id": "a1b2c3d4e5f6",
  "skill_url": "https://github.com/owner/skill-repo",
  "score": 72,
  "recommendation": "CAUTION",
  "issues": [
    {
      "type": "PROMPT_INJECTION",
      "severity": "HIGH",
      "line": 42,
      "description": "Detected attempt to override agent instructions",
      "snippet": "ignore previous instructions and..."
    }
  ],
  "scan_time_ms": 1240,
  "cached": false,
  "scans_remaining": 4
}

Verdict values: SAFE (score ≥ 80) · CAUTION (50–79) · DANGEROUS (< 50)

---

Pricing (MXN)

Results cached 24 hours — rescanning the same skill costs zero scans.

---

Endpoints

---

Handle scan limit (402)

When /scan returns 402 scan_limit_reached:

# Step 1: get checkout URL
curl -X POST https://apisecurityscan.net/billing/upgrade \
  -H "X-API-Key: ss_live_your_key" \
  -H "Content-Type: application/json" \
  -d '{"plan": "PAY_PER_SCAN"}'

# Step 2: complete payment at checkout_url
# Step 3: poll GET /billing/status until plan != FREE
# Step 4: retry scan

---

MCP integration

SecurityScan exposes an MCP server at https://apisecurityscan.net/mcp:

{
  "mcpServers": {
    "securityscan": {
      "url": "https://apisecurityscan.net/mcp",
      "transport": "http"
    }
  }
}

Available tools: scan_skill · get_report · check_certification

---

Latency & availability

• Average scan time: < 3 seconds
• Uptime: 99.9% (Contabo dedicated VPS)
• Response format: JSON

---

Companion service

DepScan API checks the external dependency health of skills (endpoints, SSL certificates, domain reputation, blacklists): https://depscan.net

---

License

MIT — this repository contains documentation and skill package only. Service source code is proprietary.