Sekrd Security Scanner
Official# @sekrd/mcp-server
MCP server for [Sekrd](https://sekrd.com) — deep security audit for AI-built apps. Run security scans directly from Cursor, Claude Code, and other AI IDEs.
## Quick Start
```bash
npx -y @sekrd/mcp-server
```
## Setup
### Claude Code
```bash
claude mcp add sekrd -- npx -y @sekrd/mcp-server
```
With API key (paid plans, unlimited scans):
```bash
claude mcp add sekrd -e SEKRD_API_KEY=your_key -- npx -y @sekrd/mcp-server
```
### Cursor
Add to `.cursor/mcp.json`:
```json
{
"mcpServers": {
"sekrd": {
"command": "npx",
"args": ["-y", "@sekrd/mcp-server"],
"env": {
"SEKRD_API_KEY": "your_key_here"
}
}
}
}
```
### Claude Desktop
Add to `claude_desktop_config.json`:
```json
{
"mcpServers": {
"sekrd": {
"command": "npx",
"args": ["-y", "@sekrd/mcp-server"],
"env": {
"SEKRD_API_KEY": "your_key_here"
}
}
}
}
```
## API Key
- **Without key**: 10 free scans per month (IP rate limit)
- **With key**: Unlimited scans on Pre-Launch Audit ($39 one-time) or Continuous Pro ($24-$29/mo) plans
Get your key at [sekrd.com/dashboard/settings](https://sekrd.com/dashboard/settings).
## Tools
| Tool | Description |
|------|-------------|
| `scan_url(url)` | Full security scan. Returns score, verdict (SHIP/BLOCK), findings + fix prompts. |
| `get_scan(scan_id)` | Get results of a previous scan. |
| `list_findings(scan_id)` | Get only findings with fix prompts for your IDE. |
## Example
```
You: Scan https://my-app.vercel.app for security issues
Sekrd: Score 34/100 — BLOCK
3 critical, 5 high, 2 medium findings
1. [CRITICAL] Stripe live secret key exposed in client bundle
Fix: Move 'sk_live_...' to .env file and use NEXT_PUBLIC_ prefix only for public keys
2. [CRITICAL] Supabase RLS policy USING(true) on users table
Fix: Replace with USING(auth.uid() = user_id)
```
## License
MIT
TDQS
Scored across 3 tools
Each tool has a clearly distinct purpose with no overlap: get_scan retrieves past results, list_findings provides fix prompts for findings, and scan_url initiates a new scan. The actions (get, list, scan) and targets (scan, findings, url) are unambiguous, making tool selection straightforward for an agent.
All tools follow a consistent verb_noun naming pattern (get_scan, list_findings, scan_url) with snake_case throughout. The verbs (get, list, scan) are appropriate and predictable, creating a cohesive and readable set that adheres to standard conventions.
Three tools are slightly minimal but reasonable for a security scanner focused on scans and findings. The set covers core operations (initiate scan, retrieve results, list findings), though it might benefit from additional tools like delete_scan or update_settings for a more complete lifecycle. It's well-scoped without being overly sparse.
The tools provide good coverage for the security scanning domain: scan_url for creation, get_scan for retrieval, and list_findings for analysis. Minor gaps exist, such as no update or delete operations for scans, and no tool for managing scan configurations or schedules, but agents can still perform essential workflows without dead ends.