Free passive security scan for AI-built apps: leaked API keys, public .env files, security headers
Scored across 3 tools
Each tool serves a distinct step in the workflow: scan_url starts a scan, get_scan retrieves scan results by reference, and list_checks explains available check categories without network access. The descriptions make the boundary between initiating, polling, and understanding checks very clear.
All names use snake_case and follow a clear verb_noun pattern: get_scan, list_checks, scan_url. The convention is predictable even though scan_url places the action verb first and the target resource second.
Three tools are well matched to a focused passive security scanning service: one starts a scan, one retrieves its result, and one describes check coverage. There is no redundant tooling, and each tool has an obvious role in the scan workflow.
The free passive scan lifecycle is mostly covered, but there is no tool to list prior scans, cancel/delete a scan, verify ownership, or retrieve the referenced full report with exact locations and fix prompts. The mention of owner-only report data suggests an obvious gap if users want remediation details beyond the free summary.
Get the free summary of a ShipLatch scan by its scan_ref (from scan_url). Use it when scan_url returned status "running". Results are kept for 7 days.
Inputs: scan_ref (required).
List the categories of security checks ShipLatch runs, which are in the free passive scan and which need ownership verification. No network access.
Inputs: no named parameters.
Run ShipLatch's free passive security scan on a public web app URL (for example a Lovable, Bolt, Replit or Cursor app). Read-only: it fetches the page and its public JS like a browser would and never logs in, submits forms or tests exploits. Returns the grade, issue counts and the type of each issue; exact locations and fix prompts stay in the full report for the verified owner. Only scan sites you own or are authorized to test. Results for the same site are cached for 24 hours. If the scan takes longer than about 25 seconds it returns status "running" and a scan_ref: call get_scan with it.
Inputs: url (required), focus.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Security scans for AI-built apps: leaked keys, open Supabase RLS, vulnerable packages, live sites.
Free security scan for AI-written GitHub repos: leaked keys, .env, eval, SQLi, CORS.
Compliance & security scan for your app: secrets, exposed files, headers, privacy, AI-disclosure.
Free passive outside security scan of a live web app: leaked keys, exposed files, open Supabase
Add one secure layer between your agents and this server.
