scanything
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| LLM_MODEL | No | Model name to use with the selected provider. | |
| VT_API_KEY | No | VirusTotal API key needed for `--vt` / `--vt-max` hash lookups. | |
| LLM_API_KEY | No | API key for a custom OpenAI-compatible provider. | |
| GITHUB_TOKEN | No | Optional GitHub token that raises GitHub's rate limit and gives access to private repositories you can read. | |
| LLM_BASE_URL | No | Base URL for a custom OpenAI-compatible provider. | |
| LLM_PROVIDER | No | Provider to use: netra, openrouter, openai, or custom. Without this, Scanything uses the first key it finds (Netra → OpenRouter → OpenAI). | |
| NETRA_API_KEY | No | API key for the Netra provider (recommended for orchestrator mode). | |
| OPENAI_API_KEY | No | API key for the OpenAI provider. | |
| OPENROUTER_API_KEY | No | API key for the OpenRouter provider. | |
| SCANYTHING_NO_RECOMMEND | No | Set to 1 to hide the Netra recommendation hint. |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| scan_fileA | Statically scan a file on disk (zip, exe, dll, script, anything) for malware and false-positive indicators. The file is never executed. Returns a compact report and a deterministic scan_id for follow-up tools. |
| scan_githubA | Download a public GitHub repository (zip archive pinned to one commit) and scan it statically: install hooks, obfuscated exec/eval, auto-run VS Code tasks, risky workflows, binaries inside, plus repository metadata. Nothing is cloned, built or run. Returns the same compact report and scan_id as scan_file. |
| get_report_sectionA | Return part of the FULL JSON report by path, e.g. 'files[1].pe.imports', 'files[0].archive.entries', 'files[2].iocs', 'engines'. Empty path lists top-level keys. |
| search_stringsB | Case-insensitive regex search over printable strings extracted from one file. |
| list_filesB | List all analyzed files with index, parent, type, size, score and sha256. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 5 tools
Each tool has a clearly distinct role: scan a local file, scan a GitHub repo, retrieve a report section, search strings in one file, or list analyzed files. The two scan tools differ by input source and the follow-up tools target different inspection needs.
All tool names follow a consistent snake_case verb_noun pattern: scan_file, scan_github, get_report_section, search_strings, list_files. There are no mixed conventions or vague names.
Five tools is well-scoped for a static malware scanning service. There are two entry-point scan tools and three focused follow-up tools, with no obvious redundancy.
The surface covers scanning local files and GitHub repos, then inspecting results via file listing, report sections, and string search. Minor gaps exist, such as no explicit full-report retrieval or batch scanning, but core workflows are covered.