KitScout

Categories › Security › Secrets & identity

Exepal

MCP serverVerified domain · exepal.comRemote● LiveFree to try

Safety tools for AI agents: safe page reader, prompt-injection, secrets, PII and MCP server scans

Install

Remote server: your requests and data go to api.exepal.com. Claude Code: claude mcp add --transport http exepal https://api.exepal.com/mcp · Claude app: Settings → Connectors → Add custom connector.

What it can do

The tools this server listed when we connected to it, in its own words.

  • client_report — A website check written for a non-technical owner and ready to send under your brand: verdict, headline, summary, what works, fixes ranked b
  • launch_scan — Pre-launch check of a live website: leaked keys in JavaScript bundles, public .env/.git, HTTPS and security headers, Google and link-preview
  • seo_report — SEO report for one website: estimated Google traffic and keywords, 12-month trend, top 100 keywords, quick wins, competitors, top pages, on-
  • seo_keywords — Keyword research: up to 50 keyword ideas for a seed keyword with monthly searches, difficulty, cost per click and intent. Use to find what p
  • seo_rank — Live Google or Bing position (top 20) of a website for up to 10 keywords, with the ranking URL and the top 3 domains. Use to check right now
  • seo_gap — Keyword gap: up to 100 keywords a competitor ranks for on Google and your site doesn't, most searched first. Use to find content ideas a com
  • rivals — Competitor report: a website next to up to 3 competitors (headline, button, prices, free plan, proof, FAQ, integrations, comparison pages),
  • safe_read — Safe page reader: one URL (web page or PDF) to clean markdown with hidden text removed and a prompt-injection verdict, in one call. Use this
  • read — Page reader: one URL to clean markdown (or text) with title, description, author, date and links. Use whenever you need the text of a web pa
  • domain — Domain intel: DNS, MX, SPF/DMARC/DKIM grade, registrar and dates (RDAP), hosting, tech stack, risk flags. Use to check a domain before trust
  • south_asia_date — Bikram Sambat (Nepali) <-> Gregorian date conversion with weekday, Nepali month names, Devanagari digits and Nepal fiscal year. Use for any
  • south_asia_number — Number to Devanagari digits, lakh/crore grouping, and words in English (Indian system) and Nepali; NPR/INR amount wording. Use to write an a
  • south_asia_phone — Nepal (+977) and India (+91) phone number check: valid, mobile/landline, operator or region, E.164. Use to validate or normalise a Nepali or
  • south_asia_id — GSTIN (checksum + state), Indian PAN, Aadhaar (Verhoeff), IFSC (bank) and Nepal PAN/VAT format checks. Use to check an Indian GSTIN, PAN, Aa
  • south_asia_forex — Official Nepal Rastra Bank exchange rates (NPR buy/sell per currency) for any day since 2000, AD or BS date, with amount conversion and up t
  • guard — Agent guard: one check for prompt injection, leaked secrets and personal data in any text or HTML, with an allow/review/block decision and a
  • scan_injection — Prompt-injection scanner: checks a web page, document or tool result for hidden instructions aimed at AI agents (hidden HTML, white text, co
  • scan_secrets — Secrets leak detector: finds API keys, tokens, private keys, seed phrases, JWTs and connection strings (AWS, GitHub, OpenAI, Anthropic, Stri
  • scan_pii — PII detector and redactor: finds emails, phone numbers, payment cards (Luhn), IBANs, Aadhaar (Verhoeff), Indian PAN, US SSN, UK NI numbers,
  • scan_mcp — MCP server audit: connects to a remote MCP server (or takes its tools, resources and prompts), grades it A-F for tool poisoning, hidden Unic
  • scan_rules — Rules-file scanner: checks CLAUDE.md, AGENTS.md, .cursorrules, .cursor/rules, copilot-instructions.md, GEMINI.md, .windsurfrules, .clinerule
  • skill_check — Skill Check: scans an OpenClaw / ClawHub, Claude Code or Codex skill (SKILL.md and its scripts) before you install it, for the patterns used
  • name_check — Business and startup name availability: .com .io .ai .co .app .dev domains, GitHub, npm, Bluesky and YouTube handles, links for X and Linked
  • agent_ready — Agent-readiness check for a website: robots.txt access for 19 AI crawlers (search, assistant and training bots from OpenAI, Anthropic, Googl
  • research_agent — Hand a research task to the Exepal Agent: it searches the web, reads public pages (hidden text and prompt injection removed), can run Exepal

KitScout test notes

Not tested by KitScout yet. When our harness runs it, pros, cons and the tasks we tried appear here, with the date and evidence.

Similar tools