secscan-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| scan_secretsA | Detect hardcoded secrets and credentials in a directory. Runs the built-in custom scanner (no extra tools). When include_git_history is true, also scans past git commits for secrets removed from the working tree but still in history — recommended before push/PR. Uses git_history (built-in) and gitleaks (when installed). |
| scan_codeA | Static analysis (SAST) for code vulnerabilities and unsafe patterns. Uses semgrep and bandit when installed; skips missing engines. |
| scan_dependenciesA | Scan lockfiles and manifests for known vulnerable dependencies (SCA). Uses osv-scanner when installed. |
| scan_iacB | Scan Terraform, CloudFormation, Kubernetes, and other IaC for misconfigurations. Uses checkov when installed. |
| scan_allA | Run every installed scanner (secrets, SAST, dependencies, IaC) and return one unified, deduplicated report. Set include_git_history=true to also scan git commit history for leaked secrets — recommended before push/PR. |
| list_available_scannersA | List all supported scanners and whether each engine CLI is installed. Call this before scanning to know which tools will run. |
| explain_findingA | Return remediation guidance for a finding rule_id (from any scan result). Recognizes built-in secret rules, bandit test IDs (B###), semgrep rule paths, gitleaks rule names, checkov policies (CKV_*), and dependency advisories (CVE/GHSA/PYSEC), with documentation links where available. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 7 tools
Each tool has a clearly distinct purpose: scan_secrets, scan_code, scan_dependencies, and scan_iac target different security domains; scan_all is a meta-runner; list_available_scanners and explain_finding serve informational and post-scan roles. No overlap or ambiguity.
All tool names follow a consistent verb_noun pattern with a logical prefix: scan_ for scanning actions, list_ for listing, and explain_ for explanation. The naming is predictable and coherent.
Seven tools is an ideal scope for a security scanning MCP server. It covers the major scan types plus utilities for listing available scanners and explaining findings, without unnecessary bloat or missing essentials.
The tool set covers the full lifecycle of security scanning: pre-scan discovery (list_available_scanners), individual scans for all major domains (secrets, code, dependencies, IaC), a combined scan (scan_all), and post-scan remediation (explain_finding). No obvious gaps for typical use cases.