SecScan

Scan, monitor and fix a live web app from your editor: graded security reports with fix prompts.

Install

Remote server: your requests and data go to secscan.us. Claude Code: claude mcp add --transport http secscan https://secscan.us/api/mcp · Claude app: Settings → Connectors → Add custom connector.

What it can do

The tools this server listed when we connected to it, in its own words.

• scan_url — Start a SecScan security scan of a web application the user owns or is authorised to test. Returns a scan_id; most scans finish in under a m
• get_scan_status — Status of a scan (queued, scanning, analyzing, complete, failed). With wait_seconds (max 60) it waits for the scan to finish and returns the
• get_report — The finished report for a scan: grade, what the scan tested and what it skipped (a clean grade says nothing about skipped areas, so say so),
• list_recent_scans — The user's most recent scans with their status, newest first.
• list_verified_domains — Domains the user has proved they own. Only these receive active testing (injection, XSS, SSRF, access control); others get passive checks. V
• get_account — How many scans the user can still run — free scans, plan scans and credits — and their plan. Check this before starting several scans.
• start_domain_verification — Begin proving the user owns a domain, which unlocks active tests (injection, XSS, SSRF, access control) on its scans. Returns a file to publ
• check_domain_verification — Check whether the file or DNS record from start_domain_verification is live. On success the domain is verified and its next scan includes ac
• list_monitors — Sites under continuous monitoring: latest grade, last and next scan, uptime check, CVE alerts, new problems in the last scan and certificate
• add_monitor — Put a site the user owns under continuous monitoring: hourly uptime checks, CVE matching, certificate alerts and regular rescans. Runs a ful
• monitor_scan_now — Run a full scan of a monitored site now instead of waiting for its schedule — e.g. to confirm a fix. Free for plan holders; otherwise uses o
• dismiss_finding — Mark a finding as a false positive for this site, so future scans of it stop reporting it — the same as Dismiss in the app, and undoable the

KitScout test notes

Not tested by KitScout yet. When our harness runs it, pros, cons and the tasks we tried appear here, with the date and evidence.

Similar tools

• ponytail-audit 190,451 ★
  Quality audit of the whole repo: bugs, security, real load, missing tests, speed, and what to delete. Most imp
• ponytail-debt 190,451 ★
  Harvest every shortcut: comment into one debt ledger, so deferrals get tracked instead of forgotten. One-shot
• security-and-hardening 117,221 ★
  Hardens code against vulnerabilities. Use when auditing an input handler for vulnerabilities, when handling us
• deal-with-security-advisory
• html-ppt-knowledge-arch-blueprint