Free first-pass triage
MCP Server Security Scan
Check a public GitHub MCP server, agent tool repo, or private local folder for practical launch risks: remote transports, write actions, credential paths, auth boundaries, redaction, tests, and CI. The scan runs in the browser, does not install dependencies, and does not execute target code.
Public repo scan
Paste a GitHub repo URL
Public repos can be scanned from a URL. The scanner fetches selected text files through GitHub and raw file endpoints, then builds a first-pass report you can attach to an audit request.
Shareable format: scan.html?repo=https://github.com/org/repo
Private repo scan
Keep private code local
For private repos, use the local folder selector on the scanner page. Selected files are read by the browser page and are not uploaded by this static site.
From scan to paid audit
Turn a weak signal into a fix plan
The free scanner is a triage helper, not a certification. A paid sprint reviews one repo or product slice and returns a boundary map, ranked findings, reproduction evidence, tests to add, and launch notes.
What it looks for
Signals the scanner highlights
- MCP server setup, transports, bind addresses, hosted entrypoints, and agent-facing APIs.
- Write, destructive, privileged, external API, filesystem, browser, shell, database, and cloud tool paths.
- Credential loading, auth checks, secret redaction, logging, error handling, and tool output exposure.
- Tests, CI, schemas, and documentation that prove risky tools fail closed before launch.