{"uid":"cap_8YMQ2y4BPKNCW40YEzmCJ","slug":"mcp-server-security-scanner-synthora-mcpscan-ee583c94","name":"MCP Server Security Scanner (SYNTHORA mcpscan)","description":"MCP Server Security Scan: probes an MCP server (JSON-RPC initialize + tools/list) and applies a deterministic rule engine over its tools — embedded secrets, dangerous shell/exec/filesystem capabilities, prompt-injection surface, hidden unicode, permissive input schemas, and auth/TLS/CORS headers — returning a security_score + findings[]. The trust layer for the agent economy. Zero-LLM, Ed25519-signed. 0.05 USDC via x402 on Base. SYNTHORA.","url":"https://mcpscan.hergertsynthora.com/service","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"url":{"type":"string","description":"MCP server URL (Streamable-HTTP endpoint)"},"manifest":{"type":"object","description":"Or paste the MCP manifest (serverInfo + tools) directly"}}},"responseSchema":{"type":"json","example":{"ok":true,"niche":"mcp_scan","result":{"counts":{"low":0,"high":2,"medium":2,"critical":1},"signed":"ed25519","target":"https://mcp.example.dev/mcp","verdict":"critico","findings":[{"id":"MCP-S01","rule":"secret_in_manifest","tool":"read_file","detail":"openai_key embedded in tool","severity":"critical"}],"tools_scanned":2,"security_score":14}}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.05","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.05/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.05","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.05","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_QFm0u6afKNLQCgsxMtaKS","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.05","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Probes an MCP server and runs a deterministic rule engine to detect secrets, dangerous capabilities, prompt injection, and misconfigurations, returning a security score and structured findings","exampleAgentPrompt":"Can you security-scan the MCP server at https://myserver.example.com/mcp — I want to know if it has any embedded secrets, dangerous shell capabilities, or prompt injection risks before I let my agent connect to it?","exampleUseCases":null,"resultDescription":"Returns a security_score (numeric) and a findings[] array detailing specific issues found: embedded secrets, dangerous shell/exec/filesystem tools, prompt injection surface exposure, hidden unicode, permissive input schemas, and auth/TLS/CORS header misconfigurations. Response is Ed25519-signed for integrity assurance.","failureModes":["MCP server URL unreachable or returns non-JSON-RPC response","Provided manifest missing required serverInfo or tools fields","Invalid URL format in request body","MCP server times out during JSON-RPC initialize probe","Payment not completed (x402 402 response returned before scan executes)"],"whenToPreferThis":"Use this endpoint when you need to vet an MCP server before connecting an AI agent to it — especially when evaluating third-party or community MCP servers. Prefer this over manual review when you need a deterministic, rule-based (zero-LLM) security score with cryptographically signed results. Ideal for agent orchestration pipelines that need automated trust gating before tool registration.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-14T12:38:49.054Z","isFirstParty":false}