SecurityScan

Check if a skill has been certified as safe.

Certification indicates the skill has been scanned, reviewed,
and approved by a human administrator. Certified skills have
a cryptographic hash that can be verified. Does not consume scan credits.

Args:
    skill_url: The skill URL to check certification for

Returns:
    CertificationResult indicating if the skill is certified,
    along with certification details if available.

Example:
    check_certification("https://github.com/anthropics/anthropic-cookbook")

Get the public security report for a skill.

Returns the most recent scan results and certification status.
This is useful to check if a skill has been previously scanned
without triggering a new scan. Does not consume scan credits.

Args:
    skill_url: The skill URL to get the report for

Returns:
    ReportResult with score, certification status, and issues summary.
    Returns error if no report exists for this URL.

Example:
    get_report("https://github.com/jlowin/fastmcp")

Scan a GitHub repository or skill URL for security vulnerabilities.

This tool performs static analysis and AI-powered detection to identify:
- Hardcoded credentials and API keys
- Remote code execution patterns
- Data exfiltration attempts
- Privilege escalation risks
- OWASP LLM Top 10 vulnerabilities

Requires a valid X-API-Key header. Cached results (24h) do not consume credits.

Args:
    skill_url: GitHub repository URL (e.g., https://github.com/owner/repo)
               or raw file URL to scan

Returns:
    ScanResult with security score (0-100), recommendation, and detected issues.
    Score >= 80 is SAFE, 50-79 is CAUTION, < 50 is DANGEROUS.

Example:
    scan_skill("https://github.com/anthropics/anthropic-sdk-python")