MCP Security Scanner
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Server capabilities have not been inspected yet.
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| scan_dependenciesA | Escanea vulnerabilidades en las dependencias del package.json usando npm audit. Retorna un listado de vulnerabilidades ordenadas por severidad con soluciones recomendadas. |
| scan_code_vulnerabilitiesA | Escanea el código fuente del proyecto buscando patrones de código vulnerable como XSS, eval(), innerHTML sin sanitizar, tokens en localStorage, etc. Retorna vulnerabilidades con ubicación exacta y soluciones. |
| scan_secretsC | Escanea el código fuente buscando secrets expuestos como API keys, tokens, contraseñas hardcodeadas, claves privadas, connection strings de bases de datos, etc. |
| generate_security_reportA | Genera un reporte completo de seguridad en español que incluye: vulnerabilidades en dependencias (npm audit), vulnerabilidades en código fuente y secrets expuestos. El reporte se guarda en formato Markdown con todas las vulnerabilidades priorizadas por severidad y soluciones recomendadas. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 4 tools
The tools have overlapping purposes that could cause confusion. 'scan_code_vulnerabilities' and 'scan_secrets' both scan source code, and 'generate_security_report' appears to aggregate results from the other scans, creating ambiguity about when to use it versus the individual scan tools. However, the descriptions help clarify their specific focuses, preventing complete misselection.
All tool names follow a consistent snake_case pattern with a clear 'verb_noun' structure: 'generate_security_report', 'scan_code_vulnerabilities', 'scan_dependencies', and 'scan_secrets'. This predictability makes it easy for an agent to understand and navigate the toolset.
With 4 tools, the count is well-scoped for a security scanner server. Each tool serves a distinct function within the domain, and there are no extraneous or missing tools that would make the set feel too thin or bloated.
The toolset covers key security scanning areas: code vulnerabilities, dependencies, and secrets, with a reporting tool to aggregate results. Minor gaps exist, such as the lack of tools for remediation actions or scanning configuration files, but agents can work around these by using the provided tools effectively for core workflows.