scannd-mcp

scannd-mcp

MCP server for Scannd — trigger security scans and read reports/vulnerabilities directly from AI agents (Claude Desktop, Claude Code, Cursor, etc.).

It runs locally over stdio and calls the hosted Scannd REST API at https://api.scannd.com. Nothing to self-host; you just need an API key.

Quick start

npx scannd-mcp

The server needs one environment variable, SCANND_API_KEY, which it sends to the API as the X-API-Key header:

SCANND_API_KEY=sk_your_key_here npx scannd-mcp

Get a key at https://scannd.com. The free tier includes 2 scans/month — enough to try the full trigger → poll → report flow end to end.

Client configuration

Add this to your MCP client config (e.g. Claude Desktop claude_desktop_config.json, or .mcp.json for Claude Code):

{
  "mcpServers": {
    "scannd": {
      "command": "npx",
      "args": ["-y", "scannd-mcp"],
      "env": {
        "SCANND_API_KEY": "sk_your_key_here"
      }
    }
  }
}

The API key is your credential — keep it in the client's env/secrets, never commit it.

Environment variables

Variable	Required	Default	Purpose
SCANND_API_KEY	yes	—	Your sk_-prefixed key. Sent as the X-API-Key request header.
SCANND_BASE_URL	no	https://api.scannd.com	Override the API endpoint (rarely needed).

Tools

Tools are discovered at runtime via the MCP tools/list request — they are not declared statically. This server exposes 8:

Tool	What it does
trigger_scan	Queue a security scan for a target; returns a scan_id to poll.
get_scan_status	Poll the status of a previously triggered scan.
list_reports	List past scan reports for a target (metadata only).
get_report	Get the full content of a specific report (or the latest, if report_id is omitted).
get_vulnerabilities	Get findings from a report, optionally filtered by severity.
get_domain_summary	High-level summary of a target: subscription tier, scan history, and vulnerability counts.
list_templates	List the scan tiers available to trigger_scan.
list_targets	List the targets this API key can act on (id, domain, label).

Requirements

• Node.js >= 18 (uses the built-in global fetch).

License

MIT — see LICENSE.