repo-security-scan-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| PYTHON | No | Set this if your Python executable is not `python` (Windows) or `python3` (macOS/Linux). |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| scan_repoA | Scans a local project folder (Next.js, Vite, Express, Supabase, Firebase style) for leaked secrets, secrets exposed to the browser, missing Supabase row-level security, wildcard CORS, open Firebase rules, dangerous code patterns and API routes without a visible auth check. Returns counts plus findings ordered by severity. Secrets are redacted. |
| triage_summaryA | Runs the same scan and returns a short plain-English triage: what to fix first and why. Good for a quick go/no-go before deploying. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 2 tools
scan_repo and triage_summary both run 'the same scan', so their boundaries are blurry; the distinction is purely output format (raw findings by severity vs. plain-English prioritization). An agent wanting a prioritized answer versus full findings has some guidance, but the overlap invites misselection.
Both names use snake_case and are readable, but scan_repo is a clear verb_noun while triage_summary is a noun phrase (verb/domain mix). Minor deviation within an otherwise consistent style.
Two tools for a full security scanner is on the thin side. The scan/summarize pair covers the headline workflow, but there is no room for narrower operations like scanning a single file or listing rule metadata.
Core scan-and-report is present, but notable gaps exist: no way to fetch details for a single finding, filter/ignore rules, manage a baseline, or run in a CI-oriented mode. Agents can work around these by re-running scans, but the lifecycle is partial.