Pricing

from $50.00 / 1,000 mcp server scanneds

Try for free

Go to Apify Store

MCP Security Scanner

Try for free

Static security analysis of Model Context Protocol (MCP) servers: risky tool capabilities, dangerous tool combinations, prompt-injection in tool metadata, credential exposure and missing auth. For AI agent builders.

Pricing

from $50.00 / 1,000 mcp server scanneds

Rating

0.0

(0)

Developer

Justin Hagerty

Actor stats

Bookmarked

Total users

Monthly active users

13 days ago

Last modified

Categories

Developer tools

You can access the MCP Security Scanner programmatically from your own applications by using the Apify API. You can also choose the language preference from below. To use the Apify API, you’ll need an Apify account and your API token, found in API & Integrations in Apify Console.

Python

JavaScript

CLI

OpenAPI

HTTP

MCP

{
  "openapi": "3.0.1",
  "info": {
    "version": "0.1",
    "x-build-id": "hDsZkNLKGdfRIVdly"
  },
  "servers": [
    {
      "url": "https://api.apify.com/v2"
    }
  ],
  "paths": {
    "/acts/michiganpublictech~mcp-security-scanner/run-sync-get-dataset-items": {
      "post": {
        "operationId": "run-sync-get-dataset-items-michiganpublictech-mcp-security-scanner",
        "x-openai-isConsequential": false,
        "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.",
        "tags": [
          "Run Actor"
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/inputSchema"
              }
            }
          }
        },
        "parameters": [
          {
            "name": "token",
            "in": "query",
            "required": true,
            "schema": {
              "type": "string"
            },
            "description": "Enter your Apify token here"
          }
        ],
        "responses": {
          "200": {
            "description": "OK"
          }
        }
      }
    },
    "/acts/michiganpublictech~mcp-security-scanner/runs": {
      "post": {
        "operationId": "runs-sync-michiganpublictech-mcp-security-scanner",
        "x-openai-isConsequential": false,
        "summary": "Executes an Actor and returns information about the initiated run in response.",
        "tags": [
          "Run Actor"
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/inputSchema"
              }
            }
          }
        },
        "parameters": [
          {
            "name": "token",
            "in": "query",
            "required": true,
            "schema": {
              "type": "string"
            },
            "description": "Enter your Apify token here"
          }
        ],
        "responses": {
          "200": {
            "description": "OK",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/runsResponseSchema"
                }
              }
            }
          }
        }
      }
    },
    "/acts/michiganpublictech~mcp-security-scanner/run-sync": {
      "post": {
        "operationId": "run-sync-michiganpublictech-mcp-security-scanner",
        "x-openai-isConsequential": false,
        "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.",
        "tags": [
          "Run Actor"
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/inputSchema"
              }
            }
          }
        },
        "parameters": [
          {
            "name": "token",
            "in": "query",
            "required": true,
            "schema": {
              "type": "string"
            },
            "description": "Enter your Apify token here"
          }
        ],
        "responses": {
          "200": {
            "description": "OK"
          }
        }
      }
    }
  },
  "components": {
    "schemas": {
      "inputSchema": {
        "type": "object",
        "properties": {
          "serverDefinitions": {
            "title": "MCP server definitions (JSON)",
            "type": "array",
            "description": "One or more JSON documents. Each item may be: a tools/list result ({\"tools\": [...]}) or a bare array of tools; a client config ({\"mcpServers\": {...}} from Claude Desktop / Cursor / Windsurf, or VS Code {\"servers\": {...}}); an MCP registry server.json manifest; or a single server object ({\"name\", \"command\"/\"url\", \"tools\"}). Every server found is one scanned target (one 'server-scanned' event). The prefilled demo is a fictional server that triggers a few findings."
          },
          "definitionUrls": {
            "title": "Definition URLs",
            "type": "array",
            "description": "Public URLs of JSON definition files in any of the formats above (e.g. a raw GitHub link to a server.json or an exported tools/list result). Fetched once with a size limit; private and internal addresses are refused.",
            "items": {
              "type": "string"
            }
          },
          "serverUrls": {
            "title": "Remote MCP endpoints",
            "type": "array",
            "description": "Streamable HTTP MCP endpoints (e.g. https://mcp.example.com/mcp) to list tools from. Requires 'Enable remote discovery' and the authorization confirmation. Only initialize, tools/list, prompts/list and resources/list are sent — tools are never called.",
            "items": {
              "type": "string"
            }
          },
          "remoteDiscovery": {
            "title": "Enable remote discovery",
            "type": "boolean",
            "description": "Connect to the endpoints in 'Remote MCP endpoints' and list their tools, prompts and resources (metadata only).",
            "default": false
          },
          "confirmAuthorization": {
            "title": "I am authorized to scan these endpoints",
            "type": "boolean",
            "description": "Confirm that you own, or have explicit permission to scan, every endpoint in 'Remote MCP endpoints'. Remote discovery never runs without this confirmation.",
            "default": false
          },
          "remoteAuthHeader": {
            "title": "Authorization header for remote endpoints",
            "type": "string",
            "description": "Optional value of the Authorization header (e.g. 'Bearer <token>') sent only to the endpoints in 'Remote MCP endpoints'. Never sent anywhere else, never stored in the output. Use a read-only or short-lived token."
          },
          "baselineHashes": {
            "title": "Baseline tool hashes (rug-pull detection)",
            "type": "object",
            "description": "Paste 'data.tool_hashes' (or 'data.tool_hash_details') from a previous, approved run: an object mapping '<server>/<tool>' to its SHA-256 definition hash. Changed, added and removed tools are reported."
          },
          "minSeverity": {
            "title": "Minimum severity to report",
            "enum": [
              "info",
              "low",
              "medium",
              "high",
              "critical"
            ],
            "type": "string",
            "description": "Only include findings at or above this severity in the output. The score is always computed from all findings, so filtering does not change it.",
            "default": "info"
          },
          "failOnSeverity": {
            "title": "Fail the run at severity",
            "enum": [
              "none",
              "critical",
              "high",
              "medium",
              "low"
            ],
            "type": "string",
            "description": "CI gate: mark the run as FAILED when any reported finding is at or above this severity. Results are still saved. 'none' disables the gate.",
            "default": "none"
          },
          "disabledRules": {
            "title": "Disabled rules",
            "type": "array",
            "description": "Rule IDs to skip, e.g. MCP-SCHEMA-006. See the rule catalog (RULES.md). Requires a plan with the 'custom_rules' feature (Pro and above); otherwise ignored with a note.",
            "items": {
              "type": "string"
            }
          },
          "licenseKey": {
            "title": "License key",
            "type": "string",
            "description": "Optional. Enterprise, prepaid or self-hosted license key (AFY1.…). Apify Store users do not need one."
          }
        }
      },
      "runsResponseSchema": {
        "type": "object",
        "properties": {
          "data": {
            "type": "object",
            "properties": {
              "id": {
                "type": "string"
              },
              "actId": {
                "type": "string"
              },
              "userId": {
                "type": "string"
              },
              "startedAt": {
                "type": "string",
                "format": "date-time",
                "example": "2025-01-08T00:00:00.000Z"
              },
              "finishedAt": {
                "type": "string",
                "format": "date-time",
                "example": "2025-01-08T00:00:00.000Z"
              },
              "status": {
                "type": "string",
                "example": "READY"
              },
              "meta": {
                "type": "object",
                "properties": {
                  "origin": {
                    "type": "string",
                    "example": "API"
                  },
                  "userAgent": {
                    "type": "string"
                  }
                }
              },
              "stats": {
                "type": "object",
                "properties": {
                  "inputBodyLen": {
                    "type": "integer",
                    "example": 2000
                  },
                  "rebootCount": {
                    "type": "integer",
                    "example": 0
                  },
                  "restartCount": {
                    "type": "integer",
                    "example": 0
                  },
                  "resurrectCount": {
                    "type": "integer",
                    "example": 0
                  },
                  "computeUnits": {
                    "type": "integer",
                    "example": 0
                  }
                }
              },
              "options": {
                "type": "object",
                "properties": {
                  "build": {
                    "type": "string",
                    "example": "latest"
                  },
                  "timeoutSecs": {
                    "type": "integer",
                    "example": 300
                  },
                  "memoryMbytes": {
                    "type": "integer",
                    "example": 1024
                  },
                  "diskMbytes": {
                    "type": "integer",
                    "example": 2048
                  }
                }
              },
              "buildId": {
                "type": "string"
              },
              "defaultKeyValueStoreId": {
                "type": "string"
              },
              "defaultDatasetId": {
                "type": "string"
              },
              "defaultRequestQueueId": {
                "type": "string"
              },
              "buildNumber": {
                "type": "string",
                "example": "1.0.0"
              },
              "containerUrl": {
                "type": "string"
              },
              "usage": {
                "type": "object",
                "properties": {
                  "ACTOR_COMPUTE_UNITS": {
                    "type": "integer",
                    "example": 0
                  },
                  "DATASET_READS": {
                    "type": "integer",
                    "example": 0
                  },
                  "DATASET_WRITES": {
                    "type": "integer",
                    "example": 0
                  },
                  "KEY_VALUE_STORE_READS": {
                    "type": "integer",
                    "example": 0
                  },
                  "KEY_VALUE_STORE_WRITES": {
                    "type": "integer",
                    "example": 1
                  },
                  "KEY_VALUE_STORE_LISTS": {
                    "type": "integer",
                    "example": 0
                  },
                  "REQUEST_QUEUE_READS": {
                    "type": "integer",
                    "example": 0
                  },
                  "REQUEST_QUEUE_WRITES": {
                    "type": "integer",
                    "example": 0
                  },
                  "DATA_TRANSFER_INTERNAL_GBYTES": {
                    "type": "integer",
                    "example": 0
                  },
                  "DATA_TRANSFER_EXTERNAL_GBYTES": {
                    "type": "integer",
                    "example": 0
                  },
                  "PROXY_RESIDENTIAL_TRANSFER_GBYTES": {
                    "type": "integer",
                    "example": 0
                  },
                  "PROXY_SERPS": {
                    "type": "integer",
                    "example": 0
                  },
                  "PROXY_UNBLOCKER_UNITS": {
                    "type": "integer",
                    "example": 0
                  }
                }
              },
              "usageTotalUsd": {
                "type": "number",
                "example": 0.00005
              },
              "usageUsd": {
                "type": "object",
                "properties": {
                  "ACTOR_COMPUTE_UNITS": {
                    "type": "integer",
                    "example": 0
                  },
                  "DATASET_READS": {
                    "type": "integer",
                    "example": 0
                  },
                  "DATASET_WRITES": {
                    "type": "integer",
                    "example": 0
                  },
                  "KEY_VALUE_STORE_READS": {
                    "type": "integer",
                    "example": 0
                  },
                  "KEY_VALUE_STORE_WRITES": {
                    "type": "number",
                    "example": 0.00005
                  },
                  "KEY_VALUE_STORE_LISTS": {
                    "type": "integer",
                    "example": 0
                  },
                  "REQUEST_QUEUE_READS": {
                    "type": "integer",
                    "example": 0
                  },
                  "REQUEST_QUEUE_WRITES": {
                    "type": "integer",
                    "example": 0
                  },
                  "DATA_TRANSFER_INTERNAL_GBYTES": {
                    "type": "integer",
                    "example": 0
                  },
                  "DATA_TRANSFER_EXTERNAL_GBYTES": {
                    "type": "integer",
                    "example": 0
                  },
                  "PROXY_RESIDENTIAL_TRANSFER_GBYTES": {
                    "type": "integer",
                    "example": 0
                  },
                  "PROXY_SERPS": {
                    "type": "integer",
                    "example": 0
                  },
                  "PROXY_UNBLOCKER_UNITS": {
                    "type": "integer",
                    "example": 0
                  }
                }
              }
            }
          }
        }
      }
    }
  }
}

MCP Security Scanner — audit Model Context Protocol servers OpenAPI definition

OpenAPI is a standard for designing and describing RESTful APIs, allowing developers to define API structure, endpoints, and data formats in a machine-readable way. It simplifies API development, integration, and documentation.

OpenAPI is effective when used with AI agents and GPTs by standardizing how these systems interact with various APIs, for reliable integrations and efficient communication.

By defining machine-readable API specifications, OpenAPI allows AI models like GPTs to understand and use varied data sources, improving accuracy. This accelerates development, reduces errors, and provides context-aware responses, making OpenAPI a core component for AI applications.

You can download the OpenAPI definitions for MCP Security Scanner from the options below:

OpenAPI.json

If you’d like to learn more about how OpenAPI powers GPTs, read our blog post.

You can also check out our other API clients:

MCP Security Scanner API in Python

MCP Security Scanner API in JavaScript

MCP Security Scanner API through CLI

MCP Security Scanner API

Business Entity Intelligence MCP Server

martc03/business-entity-mcp

MCP server for business entity research. Gives AI assistants access to OpenCorporates company data and SEC EDGAR company filings for due diligence.

CoDee

Oura MCP Server

unlimiteddots/oura-mcp-server

Oura MCP Server exposes your Oura Ring API v2 data through Model Context Protocol (MCP), so AI assistants can query sleep, activity, stress, heart rate, workouts, readiness, and more. What You Get - 15+ MCP tools covering sleep, recovery, activity, vitals, and device/profile data.

Unlimited Dots

Playwright MCP Server

jiri.spilka/playwright-mcp-server

A Model Context Protocol (MCP) server that provides browser automation capabilities using Playwright

Jiří Spilka

459

Example MCP Server

apify/example-mcp-server

This is an example MCP Server Actor written in Typescript. It doesn't do much; it just reads two numbers from its input, sums them, and pushes the result to the Actor's default dataset.

Apify

5.0

(1)

Ai Translation Context

vivid_astronaut/ai-translation-context

BRAINIALL Team

Court Records & Legal Research MCP Server

martc03/court-records-mcp

MCP server for federal court data. Gives AI assistants access to court opinions, case dockets, and judge information from the CourtListener/RECAP database.

CoDee

Real Estate MCP Server Multi-Platform Property Data for AI

alizarin_refrigerator-owner/real-estate-mcp-server

MCP Server providing AI assistants with unified access to 4+ real estate platforms through a single interface. Search properties, analyze market trends, compare listings, and generate investment reports across Zillow, Redfin, Realtor.com, and MLS.

The Howlers

Slack MCP Server

constant_quadruped/slack-mcp-server

MCP server for Slack workspaces. Read channel history, search messages, fetch thread replies, list users and channels, and post messages. Supports OAuth, Bot, and browser token authentication. Based on korotovsky/slack-mcp-server with 600+ GitHub stars.

Airbnb MCP Server — Claude, Cursor & AI Agents

makework36/airbnb-mcp-server

Plug-and-play Airbnb MCP server for Claude Desktop, Cursor and any MCP-compatible AI agent. Search listings, compare prices across cities, pull ratings, photos and coordinates — no login, no API key.

deusex machine

Competitive Intelligence MCP Server

martc03/competitive-intel-mcp

MCP server for competitive analysis. Gives AI assistants a unified view of any company by combining SEC filings, news articles, and federal contract awards.

CoDee