qa-sec-scan-mcp-server
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| secscan_scan_harA | Passively scans an existing HAR file (typically produced by QA test automation, e.g. Playwright's recordHar option) for security issues: missing security headers, insecure cookie flags, CORS misconfiguration, and more. This tool does NOT send any network requests of its own — it only analyzes HTTP traffic that already happened, captured in the HAR file. Safe to run against any environment, including production. Args:
|
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 1 tool
With a single tool there is no risk of overlap or misselection. secscan_scan_har is precisely described as a passive HAR security scanner, making its purpose unmistakable.
The tool name follows a clear snake_case verb_object convention with a consistent secscan_ prefix. Having only one tool means there are no conflicting naming patterns to confuse agents.
One tool is at the low end of the scale and the server name suggests a broader security-scanning purpose, so the surface feels thin. That said, the single tool is substantial and not trivial, so it is borderline rather than severely undersized.
For the described passive HAR-scanning domain, the tool covers the full input-analysis-output flow with a useful format option. The only potential gap is the absence of additional scan types or live-traffic scanning, but those are explicitly outside the tool's stated scope.