SecScan

Connect it to your AI

Claude Code

claude mcp add --transport http secscan https://secscan.us/api/mcp

Claude, ChatGPT, Cursor and other apps

Add it as a custom connector with this URL (Streamable HTTP):

https://secscan.us/api/mcp

This server expects extra headers, usually an API key from its maker.

Cursor, VS Code and other apps (mcp.json)

{
  "mcpServers": {
    "secscan": {
      "url": "https://secscan.us/api/mcp"
    }
  }
}

Tools it offers

12 tools, as the server itself reported during our check on Oct 31, 2026.

• scan_urlStart a SecScan security scan of a web application the user owns or is authorised to test. Returns a scan_id; most scans finish in under a minute — then call get_scan_status with wait_seconds, or get_report. Active tests
• get_scan_statusStatus of a scan (queued, scanning, analyzing, complete, failed). With wait_seconds (max 60) it waits for the scan to finish and returns the full report as soon as it does.
• get_reportThe finished report for a scan: grade, what the scan tested and what it skipped (a clean grade says nothing about skipped areas, so say so), prioritised findings with fixes and evidence, and a fix prompt written for the
• list_recent_scansThe user's most recent scans with their status, newest first.
• list_verified_domainsDomains the user has proved they own. Only these receive active testing (injection, XSS, SSRF, access control); others get passive checks. Verify more at https://secscan.us/domains.
• get_accountHow many scans the user can still run — free scans, plan scans and credits — and their plan. Check this before starting several scans.
• start_domain_verificationBegin proving the user owns a domain, which unlocks active tests (injection, XSS, SSRF, access control) on its scans. Returns a file to publish on the site, or a DNS TXT record — an editor can usually add the file to the
• check_domain_verificationCheck whether the file or DNS record from start_domain_verification is live. On success the domain is verified and its next scan includes active tests. DNS changes can take a few minutes.
• list_monitorsSites under continuous monitoring: latest grade, last and next scan, uptime check, CVE alerts, new problems in the last scan and certificate expiry. Use the monitor id with monitor_scan_now.
• add_monitorPut a site the user owns under continuous monitoring: hourly uptime checks, CVE matching, certificate alerts and regular rescans. Runs a full baseline scan straight away, which uses one of the user's scans exactly as in
• monitor_scan_nowRun a full scan of a monitored site now instead of waiting for its schedule — e.g. to confirm a fix. Free for plan holders; otherwise uses one of the user's scans, as in the app. Takes the monitor id from list_monitors.
• dismiss_findingMark a finding as a false positive for this site, so future scans of it stop reporting it — the same as Dismiss in the app, and undoable there. ONLY use this after the user has confirmed the finding is wrong; never dismi

Questions