scanbase-mcp
OfficialClick on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@scanbase-mcpscan example.ru for 152-FZ compliance and show violations with fines"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
scanbase-mcp
MCP server for ScanBase — a compliance scanner that checks live websites against the Russian personal data law 152-FZ and related regulations. Gives AI agents (Cursor, Claude Code, Claude Desktop, VS Code, Windsurf, Cline) a real website-compliance tool: scan → get violations with fines → apply machine-actionable fix instructions → rescan.
A thin wrapper over the public scanbase-api/v1 HTTP API — all scanning, gating and quota logic lives on scanbase.ru. Русская версия ниже.
Tools
Tool | What it does |
| Scans a live website → compliance score 0–100, violations with potential fines (rubles), machine-actionable fix instructions the agent can apply as code changes, document/cookie/tracker analysis. Waits for slow sites with |
| Catalog of all ~45 checks: law article, max fine. Call BEFORE writing site code to build it compliant from the start. Spends no quota. |
| Re-read a saved scan result without spending a new scan. |
| Account scan history: past scan_ids, score dynamics. |
| Tier, subscription, remaining quota. |
Recommended loop: list_checks before coding → deploy → scan_site → apply the fix instructions → scan_site again.
Related MCP server: is-it-agent-ready
Install
Requires Node ≥ 18 and a ScanBase API key (sb_live_…) — get a free one at scanbase.ru/cabinet (Account → API access). One-click Cursor install: scanbase.ru/cursor.
{
"mcpServers": {
"scanbase": {
"command": "npx",
"args": ["-y", "scanbase-mcp"],
"env": { "SCANBASE_API_KEY": "sb_live_YOUR_KEY" }
}
}
}Claude Code: claude mcp add scanbase -e SCANBASE_API_KEY=sb_live_YOUR_KEY -- npx -y scanbase-mcp
Configuration (env)
Variable | Purpose |
| Your |
| API base URL. Default |
Pricing
The tier is determined by your key's account. Free: 5 scans/day, condensed report. Scan packages and subscription unlock the full report. Docs: scanbase.ru/api · scanbase.ru/developers.
Русская версия
MCP-сервер для ScanBase — сканера сайтов на соответствие 152-ФЗ (персональные данные) и смежным законам РФ. Даёт AI-агентам (Cursor, Claude Code, Claude Desktop и др.) инструмент проверки сайтов на юридическое соответствие прямо из редактора: скан → нарушения со штрафами → машиночитаемые «как исправить» → рескан.
Инструменты
Инструмент | Что делает |
| Сканирует живой сайт → оценка 0–100, нарушения со штрафами, инструкции «как исправить» (агент применяет их как правки кода), анализ документов/cookie/трекеров. |
| Справочник всех проверок (~45): статья закона, максимальный штраф. Вызывайте ДО написания кода. Не тратит квоту. |
| Сохранённый результат по id — перечитать находки, не тратя новый скан. |
| История сканов аккаунта: прошлые scan_id, динамика балла. |
| Тариф, подписка, остаток квоты. |
Рекомендуемый цикл: list_checks до кода → деплой → scan_site → применить «как исправить» → scan_site повторно.
Установка
Нужен Node ≥ 18 и API-ключ ScanBase (sb_live_…) — бесплатный в личном кабинете (Аккаунт → API-доступ). Подключение к Cursor в один клик: scanbase.ru/cursor. Конфиг MCP — как в английской секции выше.
Пример
«Проверь https://example.ru на соответствие 152-ФЗ»
Агент вызовет scan_site и вернёт оценку, список нарушений и суммы штрафов.
Тарифы
Тариф определяется вашим ключом (аккаунтом). Free — 5 сканов/сутки, сокращённый отчёт; пакеты сканов и подписка открывают полный. Документация: scanbase.ru/api · scanbase.ru/developers.
© ScanBase (scanbase.ru) · MIT License
Available Tools
5 toolsaccountA
ScanBase account status for the configured API key: tier (free/package/subscription), remaining scan quota and reset time. Call before large scan batches or when a scan fails with a quota error. // Статус аккаунта: тариф и остаток квоты сканов.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. It discloses authentication context (configured API key), the read-only nature implied by 'status', and useful invocation triggers, but it does not explicitly confirm safety, side-effect profile, or any rate-limit behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The English portion is two efficient sentences with the core status and usage trigger front-loaded. The appended Russian translation duplicates the same content and adds token overhead without new semantic value for an agent.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter status tool with no output schema, the description is complete enough: it explains what is returned (tier, remaining quota, reset time), gives tier examples, and states when to call it. Nothing essential to correct invocation is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so the baseline is 4. The description correctly does not attempt to document absent parameters and instead focuses on return fields and usage conditions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names the exact resource (ScanBase account status) and the key returned fields: tier, remaining scan quota, and reset time. It is clearly distinguishable from the sibling scan tools, which operate on scans and checks rather than account state.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives explicit usage conditions: call before large scan batches or when a scan fails with a quota error. This is strong when-to-use guidance, though it does not state when not to use it or name alternative tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_scanA
Retrieve a previously saved ScanBase scan result by its scan_id (uuid from scan_site or list_scans). Use to re-read findings without spending a new scan. Only scans of this account; gated by the key's current tier. // Сохранённый результат скана по scan_id — перечитать находки, не тратя новый скан.
| Name | Required | Description | Default |
|---|---|---|---|
| scan_id | Yes | scan_id (uuid) из результата scan_site или list_scans |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does add real behavioral context: no scan quota is consumed, results are limited to this account, and access is gated by the key's current tier. It omits anything about response shape, freshness, or pagination, which keeps it from a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, front-loaded with the action and identifier source, then the quota-saving rationale and access constraints. The duplicated Russian line is redundant for a single-language reader, though it appears to be a deliberate localization choice rather than filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter read tool with no output schema, the description covers what it returns (saved findings), where the id comes from, quota behavior, and access gating, which is enough to call it correctly. Only the absence of any hint about result contents or freshness leaves a small gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and the single scan_id parameter is already documented as a uuid from scan_site/list_scans, which the description largely repeats. Baseline 3 applies since the schema does the heavy lifting and the description adds no new format or constraint detail.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Retrieve a previously saved ScanBase scan result') and scopes it to the scan_id identifier, which cleanly separates it from list_scans (enumerate) and scan_site (create a new scan). The named siblings remove any ambiguity about which tool fetches an existing result.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'Use to re-read findings without spending a new scan' gives a clear use condition and implicitly routes the agent away from scan_site when re-reads are wanted. It stops short of an explicit 'do not use' statement or a named alternative for when the scan_id is unknown, so it is not a full 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_checksA
List all compliance checks ScanBase performs (currently ~45): id, name, category, law article, max fine in rubles. Call this BEFORE writing site code for the Russian market to build it compliant from the start, or to explain to the user what will be verified. Requires no scan and spends no quota. // Справочник всех проверок (статья закона, штраф) — чтобы строить сайт сразу правильно, не тратя скан.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does well: it discloses that no scan is required, no quota is spent, and the approximate size (~45 items). It doesn't discuss pagination or response format, but that's a minor gap for a static list tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The English sentence is front-loaded with purpose, then usage, then a key behavioral guarantee. The Russian sentence is a useful localized duplicate of the same information, but it adds length without new content, which slightly hurts conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, the description helpfully lists the returned fields and the approximate count. It's adequate for a zero-parameter list tool, though it could mention whether results are paginated or if the list is subject to change beyond the '~45' hint.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Zero parameters, so the baseline is 4. The description adds relevant context that the returned items include id, name, category, law article, and max fine, which helps set expectations even though there's no input to document.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (List) and resource (compliance checks), plus the exact fields returned (id, name, category, law article, max fine). This clearly distinguishes it from siblings like list_scans and scan_site, which are about scans, not the static check catalog.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says when to use it: BEFORE writing site code for the Russian market to build compliant-from-start, or to explain what will be verified. It also states it requires no scan and spends no quota, which differentiates it from the scan_* siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_scansB
List this account's ScanBase scan history (last ≤100): scan_id, url, domain, score, violations count, date. Use to find a past scan_id, compare scores over time, or check scans across multiple projects. // История сканов аккаунта: найти прошлый scan_id, сравнить динамику балла.
| Name | Required | Description | Default |
|---|---|---|---|
| page | No | Страница (по умолчанию 1) | |
| per_page | No | Размер страницы, ≤50 (по умолчанию 20) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It states it lists scan history and mentions a limit of ≤100, but doesn't clarify access permissions, pagination behavior beyond the parameters, or what happens if no scans exist. For a listing tool with zero annotations, this leaves significant behavioral gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description packs substantial information into a couple of sentences, but the inclusion of a duplicate Russian translation adds unnecessary length without new information for most agents. It's front-loaded with the core purpose but could be more concise by removing the redundant translation.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a listing tool with no output schema, the description adequately covers what fields are returned and provides usage contexts. However, it lacks behavioral details like default sort order, pagination limits on total results, or permission requirements, leaving some gaps for an agent needing to invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, with both page and per_page clearly documented (defaults, max values). The description adds no additional parameter meaning beyond what the schema provides. Baseline 3 is appropriate when the schema fully documents parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly names the specific resource (ScanBase scan history) and scope (this account, last ≤100), and enumerates the returned fields. It's distinguishable from siblings like get_scan or scan_site, though it doesn't explicitly name those alternatives. The core purpose is unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It provides clear use cases: find a past scan_id, compare scores over time, or check scans across projects. These imply when to use it versus get_scan (single scan) or scan_site (new scan), but no explicit exclusions or named alternatives are stated. Strong contextual guidance without full when-not coverage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
scan_siteA
Scan a LIVE website for compliance with the Russian personal data law 152-FZ and related laws (ads 38-FZ, recommender systems 408-FZ, education 273-FZ, medicine 323-FZ). Use when the user is launching/reviewing a site for the Russian market or asks about 152-ФЗ, персональные данные, privacy, cookies, согласие, Роскомнадзор. Returns a 0–100 compliance score, violations with potential fines (rubles), machine-actionable fix instructions to apply as code changes, and document/cookie/tracker analysis. The site must be publicly reachable (not localhost). After applying fixes, call scan_site again to verify. // Проверка живого сайта на 152-ФЗ: балл, нарушения со штрафами, инструкции «как исправить» для правок кода.
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | Полный URL сайта, напр. https://example.ru/ | |
| wait | No | Дождаться результата для тяжёлого сайта (по умолчанию true). Если false — вернёт статус pending, результат позже через list_scans/get_scan. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full load and does well: it discloses the return payload (0–100 score, violations with ruble fines, machine-actionable fix instructions, document/cookie/tracker analysis), the reachability prerequisite, and the verify-by-rescanning pattern. It omits auth requirements, scan duration, and whether the target site is in any way modified.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the core purpose and densely packed with actionable detail; almost every clause earns its place. The trailing Russian one-liner is largely a restatement and adds redundancy without new information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a complex scanning tool with no output schema and no annotations, the description covers purpose, triggers, returns, prerequisites, and follow-up workflow. Remaining gaps are operational (auth, runtime, rate limits, storage of scanned data) rather than about what the tool does.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the parameter mechanics are already documented. The description still adds value by stating the URL must point to a publicly reachable live site (no localhost), a validation constraint the schema does not express.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a precise verb (scan) plus resource (a LIVE website) and the exact compliance domains checked (152-FZ, 38-FZ, 408-FZ, 273-FZ, 323-FZ). This clearly differentiates it from the retrieval-oriented siblings list_scans and get_scan.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives concrete triggers ('launching/reviewing a site for the Russian market', keyword queries like 152-ФЗ, персональные данные, cookies, Роскомнадзор) and a re-run-for-verification workflow after fixes. It also constrains applicability ('must be publicly reachable, not localhost'), though it never explicitly names get_scan as the alternative for already-completed results.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
5 tool updates
v1.1.0- First observed
account - First observed
get_scan - First observed
list_checks - First observed
list_scans - First observed
scan_site
TDQS
Scored across 5 tools
Each tool has a clearly distinct purpose: list_scans (history), get_scan (retrieve one scan by id), scan_site (perform a scan), list_checks (reference catalog), and account (quota/tier status). The potential overlap between list_scans and get_scan is well resolved by descriptions (list returns ids/summaries, get returns full saved findings).
Four of five tools follow a consistent verb_noun snake_case pattern (list_scans, list_checks, scan_site, get_scan). The lone outlier is 'account', a bare noun that breaks the verb_noun convention, but readability remains high.
Five tools is a tight, well-scoped set for a single-purpose compliance scanning service with no redundant tools. It is on the lean side, but every tool earns its place and none feels bloated.
Core lifecycle is covered: perform a scan, retrieve it, list history, see available checks, and check quota. Minor gaps exist (no delete/cleanup of stored scans, no explicit compare-scans or batch-scan operation), but agents can work around these via list_scans plus get_scan.
Maintenance
Related MCP Connectors
Scan any public site for AI-agent visibility; get scored findings, a machine-readable fix pack, and
The website checker for AI agents. One call: verdict, score out of 100, fix list.
Scan a site or AI-built app for exposed databases, keys and MCP endpoints, then verify the fixes.
Agent-readiness scanner (0-5 score), robots.txt + llms.txt generators, managed agent enablement.
Related MCP Servers
- AlicenseAqualityDmaintenanceProvides tools for AI agents to audit websites, including stack detection, DNS snapshots, and security checks.813 npmMIT
- AlicenseNot gradedqualityBmaintenanceProvides agent-readiness audits of public websites via Cloudflare's scanner, enabling users to run scans, save reports, and enforce safety boundaries from natural language.MIT
- FlicenseNot gradedqualityCmaintenanceProvides AI agents with standardized security scanning capabilities for authorized assessments, including host detection, port scanning, service fingerprinting, web vulnerability scanning, CVE verification, and report generation, all with unified JSON output and strict compliance controls.-
- FlicenseNot gradedqualityDmaintenanceEnables scanning any website for AI agent compatibility and marketing health, returning interactive dashboard reports with scores and revenue impact estimates.-