Supports x402 micropayments using USDC on Base L2 for autonomous agent scanning.
Provides tool wrappers for integration with CrewAI agent frameworks to enable MCP server scanning.
Scans public GitHub repositories for MCP server security issues.
Provides tool wrappers for integration with LangChain agent frameworks to enable MCP server scanning.
Provides an OpenAI plugin manifest for integration with ChatGPT, enabling scanning of MCP server repositories.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@compuute-scan-api scan https://github.com/modelcontextprotocol/servers"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Scan-as-a-Service for MCP servers. HTTP + MCP wrapper around compuute-scan — the MCP-specific static security scanner. Designed for agent-callable consumption.
POST a public GitHub repo URL → get a structured security report scored against 37 MCP-specific rules across 8 languages (TS/JS, Python, Go, Rust, C#, Java, Kotlin).
Honesty note (read first): compuute-scan is a pattern-breadth detector, not an exploitability oracle. Historic false-positive rate after manual validation is ~90% on raw output (verified against modelcontextprotocol/servers: 138 raw findings → 13 confirmed). Every response carries a
_disclaimerfield stating this explicitly. Use findings as a triage queue, not as a list of confirmed vulnerabilities. See docs/FP-RATES.md for per-rule transparency.
Live at https://scan.compuute.se. Service version reported by /v1/health.
Method | Path | Purpose | Auth |
POST |
| Scan a public GitHub MCP-server repo (free tier, rate-limited) | none |
POST |
| Same as above via x402 micropayment ($0.10 USDC on Base L2) |
|
GET |
| Scanner version + limits + supported ecosystems | none |
GET |
| Liveness + scanner-binary availability | none |
Method | Path | Purpose |
GET |
| OpenAPI v3 spec with per-field descriptions |
GET |
| Swagger UI for the OpenAPI spec |
Endpoint | Tool | Transport |
|
| Streamable HTTP |
Install in Claude Code: claude mcp add compuute-scan --transport http --url https://scan.compuute.se/mcp/
/.well-known/)Path | Format | Consumer |
| A2A Agent Card | Google A2A protocol |
| A2A Agent Card (alias) | A2A clients using |
| OpenAI plugin manifest | ChatGPT / OpenAI tools |
| x402 payment manifest | Coinbase Agent.market crawlers, x402 aggregators |
| Alias of | x402 probes without |
| markdown summary | LLM-driven agent-search crawlers (Exa, Perplexity-style) per llmstxt.org |
| crawler policy | search engines |
| URL index | search engines |
curl -X POST https://scan.compuute.se/v1/scan \
-H 'Content-Type: application/json' \
-H 'Idempotency-Key: 00000000-0000-0000-0000-000000000001' \
-d '{"repo_url": "https://github.com/modelcontextprotocol/servers"}'Response (truncated):
{
"repo_url": "https://github.com/modelcontextprotocol/servers",
"scanner": {"name": "compuute-scan", "version": "0.6.2", "layers_covered": ["L0", "L1"]},
"summary": {"critical": 1, "high": 94, "medium": 22, "low": 0, "files_scanned": 77},
"score": 0,
"recommendation": "AVOID — 1 critical and 94 high finding(s)...",
"top_findings": [...],
"performance": {"clone_seconds": 1.2, "scan_seconds": 0.5, "repo_size_bytes": 41234},
"_disclaimer": "PATTERN MATCH — compuute-scan is a static analyzer..."
}Related MCP server: GitHub PR Review MCP Server
Feature | How |
Idempotent retries (24h cache) |
|
HTTP cache |
|
Conditional GET |
|
Rate-limit headers |
|
Strict input validation | Pydantic |
OWASP security headers | HSTS / X-Frame-Options / X-Content-Type-Options / CSP / Referrer-Policy / Permissions-Policy |
OpenAPI for discovery |
|
MCP for agent discovery |
|
x402 for autonomous purchase |
|
Honest framing | Every response carries |
Tier | Audience | Price |
Open Source CLI | Indie devs, agent builders | $0 — |
Hosted API (free) | Agent operators evaluating MCP servers | $0 — |
Hosted API (x402) | Autonomous agents in Agent.market ecosystem | $0.10 USDC/scan — |
MCP Security Audit | Enterprises shipping MCP to production | $5K–$30K SoW |
AI Procurement Risk Audit | CFO/CTO/CISO buying enterprise AI capacity | $5K–$15K SoW |
Full breakdown with JSON-LD: https://compuute.se/pricing.
python3 -m venv venv && source venv/bin/activate
pip install -r requirements.txt
export COMPUUTE_SCAN_PATH=$HOME/compuute-scan/compuute-scan.js
uvicorn main:app --reloadpytest tests/ -v
# 34 tests covering scan, x402, MCP, discovery, OpenAPIScript | What it does |
| Start-of-session check: branch, working tree, tests, live state, next backlog item |
| End-of-session check: committer hygiene, tests, append to |
| 30-second live-state check against scan.compuute.se (4 probes) |
| Generate CycloneDX SBOM, optionally upload to a GitHub Release |
| Pull qualified prospects from GitHub + Anthropic Registry, draft DM angles |
| T0/T1/T2 distribution snapshot per docs/agent-economy-strategy.md §5 — reach, engagement, conversion measured against Railway logs + Base RPC + GitHub stars |
api/services/scan.py — clone + sandbox + scan + parse. Pure functions.
api/services/x402_service.py — x402 verify / settle via Coinbase facilitator.
api/serializers/scan_serializer.py — Pydantic models, strict validation.
api/routes/scan.py — HTTP layer for /v1/scan: idempotency, cache, ETag.
api/routes/scan_x402.py — HTTP layer for /v1/scan/pay.
api/routes/discovery.py — /.well-known/*, /robots.txt, /sitemap.xml.
api/mcp_server.py — FastMCP server exposing scan_mcp_server.
main.py — FastAPI wiring + middleware (security headers, CORS).
Bundled compuute-scan version is pinned in the Dockerfile (ARG COMPUUTE_SCAN_REF=v0.6.2).
Doc | For |
The strategic doc — a16z-verified data, the 11-signal buyer-agent model, two-track strategy, 30-day pivot trigger. Read first if you're trying to understand the company. | |
Position, pricing tiers, roadmap, decision log | |
Component diagram, request flow, threat model, deployment topology | |
Local setup, layout, code style, common pitfalls — onboard a new dev in 30 min | |
Endpoints to watch, automated checks, runbook for failures | |
Per-rule false-positive transparency | |
What this scanner reports when run against its own code | |
MCP Security Methodology v1.0 (Markdown + PDF) | |
Three anonymized engagement reports from the May 2026 batch | |
Public advisories under the | |
Self-pentest reports (90-day cadence) | |
The AI Procurement Risk Audit checklist (lead magnet) | |
SOC 2 Type I readiness statement, TSC control mapping | |
LangChain + CrewAI tool wrappers ready for PR/marketplace | |
Claude Skill package (SKILL.md + scan.sh) — submitted to anthropics/skills#1346 | |
Contributor Covenant 2.1 | |
Show HN draft + posting checklist | |
Status page (BetterStack) + analytics (PostHog) setup guides | |
Three paths to Coinbase Agent.market listing | |
GitHub Issues + Project board roadmap | |
Composted product hypotheses with gating rules | |
How to contribute | |
Vulnerability disclosure policy (90-day window) |
Found a vulnerability? See SECURITY.md — email security@compuute.se. We follow a 90-day coordinated disclosure window.
MIT (matches compuute-scan).
Compuute AB — daniel@compuute.se
This server cannot be installed
Unclaimed servers have limited discoverability.
If you are the server author, to access and configure the admin panel.
Security scanner for MCP servers. Detect vulnerabilities, prompt injection, and tool poisoning.
MCP server for ScanMalware.com URL scanning, malware detection, and analysis.
A paid remote MCP for developer endpoint scanner MCP, built to return verdicts, receipts, usage logs
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/Compuute/compuute-scan-api'
If you have feedback or need assistance with the MCP directory API, please join our Discord server