[sec]scan Run a scan →
AI editors · MCP

Scan and fix without
leaving your editor.

SecScan runs as a remote MCP server. Connect it to Claude Code, Cursor or any editor that speaks the Model Context Protocol, then ask it to scan your site: it starts the scan, reads the report and works through the fixes — the same checks as the website, with nothing to install.

Create a token →

Set it up

About five minutes. You need a SecScan account (free, with 3 scans every month) and Claude Code or Cursor. Nothing to install.

1. Create your token

  1. Sign in at secscan.us. You get a one-time code by email; there is no password to make up.
  2. Open Settings → AI editors.
  3. Type a name so you can recognise it later, for example Claude Code on my laptop, and press Create token.
  4. A box appears with your token already filled into the commands for Claude Code and Cursor. Copy it now: it is shown once. If you lose it, nothing is broken: revoke it and make another.

Treat the token like a password. Don't paste it into a chat, a public repo or a screenshot.

2. Add it to your editor

Claude Code. Open a terminal (Terminal on a Mac, PowerShell on Windows) and paste the command from the box. It looks like this:

claude mcp add --scope user --transport http secscan https://secscan.us/api/mcp --header "Authorization: Bearer ssk_YOUR_TOKEN"

Keep --scope user. Without it, Claude Code adds SecScan only to the folder you happen to be in, and it appears to be missing everywhere else. If Claude Code says secscan already exists, remove the old entry first and add it again: 

claude mcp remove secscan

Cursor. Open ~/.cursor/mcp.json (on Windows, C:\Users\you\.cursor\mcp.json), creating it if it isn't there, and paste this. If the file already lists other servers, add "secscan" inside the existing mcpServers block instead of pasting a second one:

{
  "mcpServers": {
    "secscan": {
      "url": "https://secscan.us/api/mcp",
      "headers": { "Authorization": "Bearer ssk_YOUR_TOKEN" }
    }
  }
}

Another editor. Any editor that supports remote (HTTP) MCP servers with a custom header will work: the address is https://secscan.us/api/mcp and the header is Authorization: Bearer ssk_YOUR_TOKEN.

3. Restart your editor

Quit Claude Code and start it again (or restart Cursor). An editor that was already running doesn't pick up a server you just added.

4. Check it's connected

This costs nothing and uses none of your scans. In a terminal:

claude mcp list

You should see secscan: https://secscan.us/api/mcp marked Connected. Then ask your editor:

"How many SecScan scans do I have left?"

A new account answers Free scans left: 3 of 3. If it does, you're set. In Cursor, open its MCP settings and check that secscan is listed and switched on.

5. Run your first scan

Ask your editor, using your own address:

"Scan https://yourapp.com with SecScan and fix what's urgent."

It starts the scan, waits for it (usually under a minute), reads the report, works through the most serious findings first and offers to rescan to confirm each fix. This uses one of your 3 free scans for the month. Only scan sites you own or are authorised to test.

Optional: turn on the active tests

A new site gets passive checks only. The active tests (injection, cross-site scripting, SSRF, access control) run once you've shown you own the domain, and your editor can walk you through it:

  1. Ask: "Verify that I own yourapp.com with SecScan." It gives you a DNS record to add, or a small file to publish on the site.
  2. Add it. For DNS, that's a TXT record named _secscan-challenge (your DNS provider may want the full _secscan-challenge.yourapp.com) with the value it gave you, added wherever your domain's DNS lives (Cloudflare, GoDaddy, Namecheap, IONOS and so on). For the file, your editor can add it to your code; deploy the site afterwards.
  3. Ask: "Check the verification." It usually passes straight away once the record is saved. If not, wait a minute and ask again; asking again never changes your code.

Verification belongs to your account and to the exact hostname: yourapp.com and www.yourapp.com are verified separately. Rescan afterwards and the report shows the active tests ran.

If something doesn't work

What you seeWhat to do
Failed to connect, or Missing or invalid API token The token was copied with a missing character or an extra space, or it has been revoked. Create a new token, run claude mcp remove secscan, then add it again with the new one.
SecScan's tools don't show up Restart the editor. In Claude Code, also make sure the command had --scope user; if it didn't, remove the entry and add it again.
"You've used this month's 3 free scans" That's the free allowance, and it renews on the 1st. Buying more scans isn't open yet; the message says so.
The report says active tests didn't run The domain isn't verified on this account. Follow "turn on the active tests" above, then rescan.
You lost the token It can't be shown again. Revoke it in Settings and create a new one.
You think a token has leaked Settings → AI editors → Revoke. It stops working immediately.

What your editor can do

ToolWhat it does
scan_urlStarts a scan of a site you own or are authorised to test, optionally also reading a public GitHub repository for committed secrets. Returns a scan id.
get_scan_statusReports progress. With wait_seconds (up to 60) it waits and returns the finished report — most scans finish in under a minute, so one call is usually enough.
get_reportThe report: grade, what the scan tested and what it skipped, findings most severe first with the fix and evidence for each, and a fix prompt written for your editor. 25 findings per page; offset for more, min_severity to focus.
list_recent_scansYour latest scans, newest first — so "rescan my site" works.
list_verified_domainsDomains you have proved you own. Only these get active testing.
start_domain_verificationBegins proving you own a domain. Returns a file to publish (your editor can add it to your code and deploy it) or a DNS record.
check_domain_verificationConfirms the file or DNS record is live. From then on, that domain’s scans include active tests.
get_accountHow many scans you have left — free scans, plan scans and credits — and your plan.
list_monitorsYour monitored sites: latest grade, uptime, CVE alerts, new problems since the last scan and certificate expiry.
add_monitorStarts monitoring a site and runs its baseline scan. Uses a scan, exactly as on the website; free on a plan.
monitor_scan_nowRescans a monitored site now, e.g. to confirm a fix. Uses a scan, exactly as on the website; free on a plan.
dismiss_findingMarks a finding you have confirmed is a false positive, so future scans of that site stop reporting it. Undo it from the report.

Same rules as the website

Nothing your editor does is a different kind of action. Scanning, adding a monitor, rescanning, verifying a domain and dismissing a finding all run through the website's own code, so:

  • A scan, a new monitor or a rescan uses one of your free scans, plan scans or credits, and the same rate limits apply.
  • Active tests — injection, cross-site scripting, SSRF, access control — run only on domains you have verified. Other sites get passive checks, and the report says so.
  • Private and internal addresses are refused, exactly as they are in the browser.

Tokens do one thing. A SecScan token has one scope, MCP or API, and an MCP token works only for the MCP endpoint. It can scan, monitor, verify domains and read your reports, but it cannot sign in to the website, change your password, buy anything, delete your account or create more tokens — so a token that leaks from a config file is contained. Only a hash of it is stored, and you can revoke it from Settings at any time; it stops working immediately.

Scripts, CI and other apps

Full details are on the developers page.

A token with the API scope (created under Settings, AI editors and API) works against a REST API at https://secscan.us/api/v1, described by an OpenAPI document at /api/v1/openapi.json. It can start a scan, read its status and report, and export the findings as SARIF for GitHub code scanning. A command-line tool and GitHub Action built on it can fail a build on findings or a grade below a threshold. Editors that support OAuth can instead connect with a consent screen, with no token to copy.

Limits

Up to 120 requests a minute per account across all tools, and up to three scans being waited on at once. Scans themselves follow your plan and the normal scan limits. Only scan applications you own or are authorised to test.

Connect your editor

Every account gets 3 free scans every month. Create a token and paste one line.

Create a token →