Server definition

Hash: sha256:46a367b5cec868618ec91e46f3feae1925fdccc5b0b7ac1b2ba3c6e619f1e043
What it is: What a remote MCP server returned when asked what it offers: 8 tools

The blob, as servednamed by its sha256

{
  "instructions": "ScanLabsAI security scanner. Use scan_website to assess a website, scan_agent to red-team another AI agent or MCP server (agent-to-agent scanning, OWASP LLM Top 10), compliance_report to generate a GDPR/WCAG/PCI compliance report (1 credit), get_fix_guidance to remediate findings, lookup_cves for vulnerability intelligence, check_credits for the balance, and buy_credits for a top-up link. The first scan of every website is free; further website scans, agent scans and compliance reports use AI credits from the account tied to the API key in this connection (create one at https://scanlabsai.com/mcp). Only scan targets you are authorised to test.",
  "tools": [
    {
      "description": "Get a secure Stripe checkout link to buy an AI credit pack for the signed-in account. Requires a ScanLabsAI API key in the MCP connection. Credits are added automatically once payment completes. Packs: starter (5), pro (15), agency (50).",
      "inputSchema": {
        "properties": {
          "pack": {
            "description": "Pack id: starter, pro, or agency. Defaults to pro.",
            "type": "string"
          }
        },
        "type": "object"
      },
      "name": "buy_credits",
      "outputSchema": null
    },
    {
      "description": "Check the signed-in account's AI credit balance. Requires a ScanLabsAI API key in the MCP connection (Authorization: Bearer slai_...). Create one at https://scanlabsai.com/mcp.",
      "inputSchema": {
        "properties": {},
        "type": "object"
      },
      "name": "check_credits",
      "outputSchema": null
    },
    {
      "description": "Generate a website compliance report — the same automated assessment the ScanLabsAI agency portal runs — covering GDPR/CCPA privacy, WCAG 2.1 AA accessibility, PCI DSS 4.0 payment security and general standards. Returns an overall score, per-category scores and the failing/at-risk checks with recommendations, as Markdown. Requires a ScanLabsAI API key in the connection; costs 1 AI credit per report. Only run against sites you are authorised to assess.",
      "inputSchema": {
        "properties": {
          "url": {
            "description": "The website URL to assess for compliance, e.g. https://example.com",
            "type": "string"
          }
        },
        "required": [
          "url"
        ],
        "type": "object"
      },
      "name": "compliance_report",
      "outputSchema": null
    },
    {
      "description": "Get detailed, step-by-step remediation guidance for a specific vulnerability or security issue (e.g. \"missing Content-Security-Policy header\", \"SQL injection\", a CVE id). Returns actionable fixes.",
      "inputSchema": {
        "properties": {
          "issue": {
            "description": "The vulnerability, finding title, or CVE id to fix.",
            "type": "string"
          }
        },
        "required": [
          "issue"
        ],
        "type": "object"
      },
      "name": "get_fix_guidance",
      "outputSchema": null
    },
    {
      "description": "Get ScanLabsAI pricing: the free-first-scan policy and AI credit packs.",
      "inputSchema": {
        "properties": {},
        "type": "object"
      },
      "name": "get_pricing",
      "outputSchema": null
    },
    {
      "description": "Look up recent CVEs from the NIST NVD feed, optionally filtered by keyword. Returns id, severity, score and summary.",
      "inputSchema": {
        "properties": {
          "keyword": {
            "description": "Optional keyword, e.g. \"wordpress\" or \"openssl\".",
            "type": "string"
          },
          "limit": {
            "description": "Max results (1-25). Defaults to 10.",
            "type": "number"
          }
        },
        "type": "object"
      },
      "name": "lookup_cves",
      "outputSchema": null
    },
    {
      "description": "Red-team an AI agent for security weaknesses — prompt injection, system-prompt leakage, sensitive-data disclosure, unsafe output handling and excessive agency — mapped to the OWASP LLM Top 10, and return a Markdown report. This is agent-to-agent scanning: use it to assess another agent from here. Two target kinds are supported: kind=\"openai\" for an OpenAI-compatible chat-completions endpoint, or kind=\"mcp\" for an MCP server (its tool manifest is audited for tool-poisoning and over-broad capabilities). Requires a ScanLabsAI API key in the connection; each agent scan uses 5 AI credits. Probing is active and adversarial — only scan agents you own or are authorised to test.",
      "inputSchema": {
        "properties": {
          "apiKey": {
            "description": "Optional bearer token / API key the target agent requires. Sent to the target only; not stored.",
            "type": "string"
          },
          "deep": {
            "description": "Run deeper probes (jailbreak + resource-exhaustion). Defaults to false.",
            "type": "boolean"
          },
          "endpoint": {
            "description": "The agent endpoint URL (chat-completions URL, or MCP server URL).",
            "type": "string"
          },
          "kind": {
            "description": "Target type: \"openai\" for a chat-completions endpoint, \"mcp\" for an MCP server.",
            "enum": [
              "openai",
              "mcp"
            ],
            "type": "string"
          },
          "model": {
            "description": "Model name for OpenAI-compatible endpoints, e.g. gpt-4o-mini.",
            "type": "string"
          }
        },
        "required": [
          "kind",
          "endpoint"
        ],
        "type": "object"
      },
      "name": "scan_agent",
      "outputSchema": null
    },
    {
      "description": "Run a ScanLabsAI security scan against a website and return a full Markdown vulnerability report (grouped by severity, with descriptions and remediation) that you can analyse, act on, and the user can save as security-report.md. Checks OWASP Top 10, CVEs, SSL/TLS, security headers and DNS. Use deep=true for a comprehensive scan (40,000+ vectors, slower). Only scan sites the user is authorised to test.",
      "inputSchema": {
        "properties": {
          "deep": {
            "description": "Run a deep scan (comprehensive, slower). Defaults to false.",
            "type": "boolean"
          },
          "url": {
            "description": "The website URL to scan, e.g. https://example.com",
            "type": "string"
          }
        },
        "required": [
          "url"
        ],
        "type": "object"
      },
      "name": "scan_website",
      "outputSchema": null
    }
  ]
}

Verify it yourself

curl -s https://api.teppi.xyz/v1/evidence/sha256:46a367b5cec868618ec91e46f3feae1925fdccc5b0b7ac1b2ba3c6e619f1e043 | sha256sum