@scanlabsai/mcp-server

ScanLabsAI MCP Server

Scan websites for security vulnerabilities and get fixes — directly inside Claude.

The Model Context Protocol server exposes the ScanLabsAI security engine as tools any MCP client (Claude Desktop, Claude Code, Cursor, etc.) can call.

Tools

Tool	What it does
scan_website	Run a security scan (OWASP Top 10, CVEs, SSL/TLS, headers, DNS). deep=true for a comprehensive scan.
get_fix_guidance	Step-by-step remediation for a finding or CVE.
lookup_cves	Recent CVEs from NIST NVD, optionally filtered by keyword.
check_credits	Your AI credit balance (needs an API key).
buy_credits	A secure Stripe checkout link to top up — buy without leaving Claude (needs an API key).
get_pricing	Free-first-scan policy and AI credit packs.

Credits & your API key

The first scan of every website is free. Beyond that, scans use AI credits. Create an API key at https://scanlabsai.com/mcp and pass it as SCANLABS_API_KEY (stdio) or an Authorization: Bearer header (hosted) so scans meter against your account — then buy_credits can top you up in-chat.

This package is a thin proxy to the hosted server, so the tools and metering always match the website.

Quick start

Hosted (zero install) — recommended

claude mcp add --transport http scanlabsai https://scanlabsai.com/api/mcp \
  --header "Authorization: Bearer slai_live_xxx"   # optional: meters against your account

Local via npx (stdio)

Claude Code:

claude mcp add scanlabsai --env SCANLABS_API_KEY=slai_live_xxx -- npx -y @scanlabsai/mcp-server

Claude Desktop — add to claude_desktop_config.json:

{
  "mcpServers": {
    "scanlabsai": {
      "command": "npx",
      "args": ["-y", "@scanlabsai/mcp-server"],
      "env": { "SCANLABS_API_KEY": "slai_live_xxx" }
    }
  }
}

The API key is optional — without it you get one free scan per website.

Example prompts

• "Scan example.com and summarise the critical issues."
• "Do a deep scan of my site and fix the security-header findings in this repo."
• "Look up recent CVEs for nginx and tell me if I'm affected."

Notes

• Authorisation: only scan sites you own or are permitted to test.
• The first scan of every website is free; further scans use AI credits at scanlabsai.com.
• Configuration via env vars: SCANLABS_SCAN_API_URL, SCANLABS_CVE_API_URL, SCANLABS_SITE_URL.

License

MIT