Compuute MCP Security Scanner

by Compuute

368 downloads

Not rated

GitHub

About

Scan-as-a-Service for MCP servers — HTTP+MCP wrapper around compuute-scan

Details

Author: Compuute
Downloads: 368
Categories: Developer Tools, Security

- 37 MCP-specific static analysis rules.
- Idempotent retries with 24‑hour cache.
- x402 micropayment option for autonomous agents.
- OWASP security headers and strict input validation.
- OpenAPI spec and MCP tool for agent discovery.
- Honest framing: every response includes a false-positive disclaimer.

Setting up with Highlight

This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:

Download and install Highlight from highlightai.com/download
Navigate to the plugins tab and select "Add Custom Plugin"
Configure the plugin with the settings below

Plugin Name Compuute MCP Security Scanner

Command (node, npx, python, etc.)

Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
Enable "Start Automatically" if you want the plugin to start when Highlight launches

Setting up with Cursor

Open Cursor's settings
Navigate to the MCP section
Click "Add new Global MCP server"
Copy and paste the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "compuute mcp security scanner": {
            "compuute-scan": {
                "type": "http",
                "url": "https://scan.compuute.se/mcp/"
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "compuute mcp security scanner": {
            "compuute-scan": {
                "type": "http",
                "url": "https://scan.compuute.se/mcp/"
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "compuute mcp security scanner": {
            "compuute-scan": {
                "type": "http",
                "url": "https://scan.compuute.se/mcp/"
            }
        }
    }
}

Setting up with Claude Desktop

Open Claude Desktop's settings
Go to the Integrations tab
Click "Add MCP Server"
Use the configuration below based on your operating system

Note: Make sure Claude Desktop is running before attempting to connect.

JSON

{
    "mcpServers": {
        "compuute mcp security scanner": {
            "compuute-scan": {
                "type": "http",
                "url": "https://scan.compuute.se/mcp/"
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "compuute mcp security scanner": {
            "compuute-scan": {
                "type": "http",
                "url": "https://scan.compuute.se/mcp/"
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "compuute mcp security scanner": {
            "compuute-scan": {
                "type": "http",
                "url": "https://scan.compuute.se/mcp/"
            }
        }
    }
}

Setting up with Windsurf

Open Windsurf's preferences
Go to the Integrations section
Click "Add MCP Integration"
Use the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "compuute mcp security scanner": {
            "compuute-scan": {
                "type": "http",
                "url": "https://scan.compuute.se/mcp/"
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "compuute mcp security scanner": {
            "compuute-scan": {
                "type": "http",
                "url": "https://scan.compuute.se/mcp/"
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "compuute mcp security scanner": {
            "compuute-scan": {
                "type": "http",
                "url": "https://scan.compuute.se/mcp/"
            }
        }
    }
}

Setting up with Cline

Open Cline's settings
Navigate to the Integrations section
Click "Add MCP Server"
Copy and paste the configuration below based on your operating system

Note: Make sure to restart Cline after adding the configuration.

JSON

{
    "mcpServers": {
        "compuute mcp security scanner": {
            "compuute-scan": {
                "type": "http",
                "url": "https://scan.compuute.se/mcp/"
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "compuute mcp security scanner": {
            "compuute-scan": {
                "type": "http",
                "url": "https://scan.compuute.se/mcp/"
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "compuute mcp security scanner": {
            "compuute-scan": {
                "type": "http",
                "url": "https://scan.compuute.se/mcp/"
            }
        }
    }
}

Setting up with Goose

Open Goose's preferences
Go to the Integrations tab
Select "MCP Servers"
Click "Add New Server"
Use the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "compuute mcp security scanner": {
            "compuute-scan": {
                "type": "http",
                "url": "https://scan.compuute.se/mcp/"
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "compuute mcp security scanner": {
            "compuute-scan": {
                "type": "http",
                "url": "https://scan.compuute.se/mcp/"
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "compuute mcp security scanner": {
            "compuute-scan": {
                "type": "http",
                "url": "https://scan.compuute.se/mcp/"
            }
        }
    }
}

From the repository

Send a POST request to /v1/scan with a repo_url JSON body (free, rate-limited) or use the /v1/scan/pay endpoint with an X-Payment header for micropayments. For Claude Code, run claude mcp add compuute-scan --transport http --url https://scan.compuute.se/mcp/ and then invoke the scan_mcp_server tool. The open source CLI can be run locally with npx compuute-scan ./repo.

`scan_mcp_server`

Scan a public GitHub MCP-server repository for security issues. Clones the repo (shallow, <60s, <200 MB), runs compuute-scan v0.6.2 in static analysis mode (no code execution from the target), and returns a structured report with severity counts, a 0-100 score, and the 10 most severe findings. WHEN TO USE: - Before connecting to an unknown MCP server discovered via Anthropic Registry, Smithery, mcp.so, or a Discord recommendation. - Before installing a third-party MCP-server package into a production pipeline. - As part of an agent's pre-commit / pre-deploy due-diligence step when adding new dependencies. - As one input to a multi-source trust evaluation (combine with publisher reputation, package install count, last-update recency). WHEN NOT TO USE: - For private repos. Use the on-prem CLI instead: `npx compuute-scan ./path-to-private-repo` - For deep exploitability assessment of a specific code path. This is pattern matching, not dataflow analysis. Book a manual L2-L4 audit at https://compuute.se/audit for that depth. - For non-GitHub hosts (GitLab, Bitbucket, self-hosted). v1 supports github.com only. - For repos > 200 MB or clone time > 60s. The endpoint returns a 413 or 504 in those cases — fall back to local CLI. EXPECTED RESPONSE TIME: - Median: ~1-2 seconds for small repos (<100 files). - p99: ~10 seconds for medium repos. - Hard timeout at clone=60s, scan=120s combined. EXPECTED COST: - Free tier in MVP. Future Pro tier may charge per-scan or per-month. DATA FRESHNESS: - Scanner version is reported in response.scanner.version. - L1 rule set freshness reflects compuute-scan releases — see github.com/Compuute/compuute-scan/CHANGELOG.md for the latest CVE and threat-intel response timeline. EXAMPLES: Example 1 — scan an MCP server you're evaluating: github_url = "https://github.com/modelcontextprotocol/servers" → score: 0, summary: {critical: 1, high: 94, medium: 22} → top_findings include SSRF, eval, etc. → recommendation: "AVOID — 1 critical and 94 high finding(s)..." Example 2 — scan a clean reference implementation: github_url = "https://github.com/microsoft/azure-devops-mcp" → score: 90+, summary: {critical: 0, high: 1} → recommendation: "REVIEW — 1 high finding(s)..." Example 3 — scan your own dev MCP-server before publishing: github_url = "https://github.com/yourorg/your-mcp" → audit your own surface before others install it OUTPUT FIELDS (stable schema): - repo_url (str): canonical URL of the scanned repo. - score (int): 0-100, higher safer. Coarse summary, not a precision claim. - summary (object): {critical, high, medium, low, info, files_scanned}. - recommendation (str): action guidance derived from severity counts. - findings_count (int): total raw findings (may include false positives). - top_findings (list): up to 10 most severe, each with {id, title, severity, file, line, owasp, cwe}. - l0_discovery (object): MCP transport, tool count, dependency pinning. - performance (object): clone_seconds, scan_seconds, repo_size_bytes. - scanner (object): {name, version, layers_covered}. - _disclaimer (str): MANDATORY triage disclaimer. Read it. Args: github_url: Public GitHub HTTPS URL (e.g. https://github.com/org/repo). Must be public and < 200 MB. v1 is github.com only. Returns: Structured scan result. On error, returns {"error": code, "message": ...} with HTTP-style code (invalid_url, clone_failed, scan_timeout, etc.).

Claude Desktop / Cursor

Paste into your MCP client config file to install this server.

{
    "mcpServers": {
        "compuute mcp security scanner": {
            "compuute-scan": {
                "type": "http",
                "url": "https://scan.compuute.se/mcp/"
            }
        }
    }
}

McpServers

{
    "compuute-scan": {
        "type": "http",
        "url": "https://scan.compuute.se/mcp/"
    }
}

compuute-scan-api

Scan-as-a-Service for MCP servers. HTTP + MCP wrapper around compuute-scan — the MCP-specific static security scanner. Designed for agent-callable consumption.

POST a public GitHub repo URL → get a structured security report scored against 37 MCP-specific rules across 8 languages (TS/JS, Python, Go, Rust, C#, Java, Kotlin).

> Honesty note (read first): compuute-scan is a pattern-breadth detector, not an exploitability oracle. Historic false-positive rate after manual validation is ~90% on raw output (verified against modelcontextprotocol/servers: 138 raw findings → 13 confirmed). Every response carries a _disclaimer field stating this explicitly. Use findings as a triage queue, not as a list of confirmed vulnerabilities. See docs/FP-RATES.md for per-rule transparency.

Live at <https://scan.compuute.se>. Service version reported by /v1/health.

---

Endpoints

Core scan

| Method | Path | Purpose | Auth |
|--------|------|---------|------|
| POST | /v1/scan | Scan a public GitHub MCP-server repo (free tier, rate-limited) | none |
| POST | /v1/scan/pay | Same as above via x402 micropayment ($0.10 USDC on Base L2) | X-Payment header |
| GET | /v1/scan/info | Scanner version + limits + supported ecosystems | none |
| GET | /v1/health | Liveness + scanner-binary availability | none |

Machine-readable contracts

| Method | Path | Purpose |
|--------|------|---------|
| GET | /openapi.json | OpenAPI v3 spec with per-field descriptions |
| GET | /docs | Swagger UI for the OpenAPI spec |

MCP server (live)

| Endpoint | Tool | Transport |
|----------|------|-----------|
| /mcp/ | scan_mcp_server(github_url) | Streamable HTTP |

Install in Claude Code: claude mcp add compuute-scan --transport http --url https://scan.compuute.se/mcp/

Discovery (`/.well-known/`)

| Path | Format | Consumer |
|------|--------|----------|
| /.well-known/agent.json | A2A Agent Card | Google A2A protocol |
| /.well-known/agent-card.json | A2A Agent Card (alias) | A2A clients using -card.json naming |
| /.well-known/ai-plugin.json | OpenAI plugin manifest | ChatGPT / OpenAI tools |
| /.well-known/x402.json | x402 payment manifest | Coinbase Agent.market crawlers, x402 aggregators |
| /.well-known/x402 | Alias of x402.json | x402 probes without .json suffix |
| /llms.txt | markdown summary | LLM-driven agent-search crawlers (Exa, Perplexity-style) per llmstxt.org |
| /robots.txt | crawler policy | search engines |
| /sitemap.xml | URL index | search engines |

Example

curl -X POST https://scan.compuute.se/v1/scan \
  -H 'Content-Type: application/json' \
  -H 'Idempotency-Key: 00000000-0000-0000-0000-000000000001' \
  -d '{"repo_url": "https://github.com/modelcontextprotocol/servers"}'

Response (truncated):

{
  "repo_url": "https://github.com/modelcontextprotocol/servers",
  "scanner": {"name": "compuute-scan", "version": "0.6.2", "layers_covered": ["L0", "L1"]},
  "summary": {"critical": 1, "high": 94, "medium": 22, "low": 0, "files_scanned": 77},
  "score": 0,
  "recommendation": "AVOID — 1 critical and 94 high finding(s)...",
  "top_findings": [...],
  "performance": {"clone_seconds": 1.2, "scan_seconds": 0.5, "repo_size_bytes": 41234},
  "_disclaimer": "PATTERN MATCH — compuute-scan is a static analyzer..."
}

Agent-shaped API features

| Feature | How |
|---------|-----|
| Idempotent retries (24h cache) | Idempotency-Key header |
| HTTP cache | ETag + Cache-Control: public, max-age=1800 |
| Conditional GET | If-None-Match → 304 Not Modified |
| Rate-limit headers | X-RateLimit-Limit/Remaining/Reset |
| Strict input validation | Pydantic extra="forbid", GitHub-HTTPS-only |
| OWASP security headers | HSTS / X-Frame-Options / X-Content-Type-Options / CSP / Referrer-Policy / Permissions-Policy |
| OpenAPI for discovery | GET /openapi.json with descriptions on every field |
| MCP for agent discovery | /mcp/ exposes scan_mcp_server tool |
| x402 for autonomous purchase | /v1/scan/pay returns 402 with USDC/Base payment requirements |
| Honest framing | Every response carries _disclaimer — pattern match, not exploitability claim |

Pricing

| Tier | Audience | Price |
|------|----------|-------|
| Open Source CLI | Indie devs, agent builders | $0 — npx compuute-scan ./repo |
| Hosted API (free) | Agent operators evaluating MCP servers | $0 — POST /v1/scan, rate-limited |
| Hosted API (x402) | Autonomous agents in Agent.market ecosystem | $0.10 USDC/scan — POST /v1/scan/pay |
| MCP Security Audit | Enterprises shipping MCP to production | $5K–$30K SoW |
| AI Procurement Risk Audit | CFO/CTO/CISO buying enterprise AI capacity | $5K–$15K SoW |

Full breakdown with JSON-LD: <https://compuute.se/pricing>.

Local development

python3 -m venv venv && source venv/bin/activate
pip install -r requirements.txt
export COMPUUTE_SCAN_PATH=$HOME/compuute-scan/compuute-scan.js
uvicorn main:app --reload

Tests

```bash
pytest tests/ -v

No reviews yet — be the first

Use Google, GitHub, or an email account so ratings stay tied to real people.

Email sign in

No reviews posted yet.

About

Details

Jump to

Setting up with Highlight

From the repository

scan_mcp_server

Claude Desktop / Cursor

McpServers

compuute-scan-api

Endpoints

Core scan

Machine-readable contracts

MCP server (live)

Discovery (/.well-known/)

Example

Agent-shaped API features

Pricing

Local development

Tests

Install

More like this

Sentry

Github

Git

GitLab

Context 7

Playwright

`scan_mcp_server`

Discovery (`/.well-known/`)