Scan a website for vulnerabilities: OWASP Top 10, CVEs, SSL, headers - with plain-English fixes
Inferred from the transports this listing declares (streamable-http). A client not listed here hasn’t been ruled out — it just isn’t something Forge can confirm.
Verification confirms publisher identity (repo ownership), not code safety. The security scan covers known CVEs and suspicious install scripts.
Read from a real MCP initialize → tools/list handshake against the declared endpoint. No tool was ever invoked — tools/list is the read-only introspection call the protocol defines for this. It reflects what the server advertised at that moment; a hosted endpoint is not pinned to any version and can change without notice.
https://scanlabsai.com/api/mcp8 tools · 152msscan_websiteRun a ScanLabsAI security scan against a website and return a full Markdown vulnerability report (grouped by severity, with descriptions and remediation) that you can analyse, act on, and the user can save as security-report.md. Checks OWASP Top 10, CVEs, SSL/TLS, security headers and DNS. Use deep…Run a ScanLabsAI security scan against a website and return a full Markdown vulnerability report (grouped by severity, with descriptions and remediation) that you can analyse, act on, and the user can save as security-report.md. Checks OWASP Top 10, CVEs, SSL/TLS, security headers and DNS. Use deep…
url: Links to undeclared domain: example.com| Parameter | Type | Description |
|---|---|---|
| url* | string | The website URL to scan, e.g. https://example.com |
| deep | boolean | Run a deep scan (comprehensive, slower). Defaults to false. |
scan_agentRed-team an AI agent for security weaknesses — prompt injection, system-prompt leakage, sensitive-data disclosure, unsafe output handling and excessive agency — mapped to the OWASP LLM Top 10, and return a Markdown report. This is agent-to-agent scanning: use it to assess another agent from here. T…Red-team an AI agent for security weaknesses — prompt injection, system-prompt leakage, sensitive-data disclosure, unsafe output handling and excessive agency — mapped to the OWASP LLM Top 10, and return a Markdown report. This is agent-to-agent scanning: use it to assess another agent from here. T…
| Parameter | Type | Description |
|---|---|---|
| kind* | string | Target type: "openai" for a chat-completions endpoint, "mcp" for an MCP server. |
| endpoint* | string | The agent endpoint URL (chat-completions URL, or MCP server URL). |
| apiKey | string | Optional bearer token / API key the target agent requires. Sent to the target only; not stored. |
| model | string | Model name for OpenAI-compatible endpoints, e.g. gpt-4o-mini. |
| deep | boolean | Run deeper probes (jailbreak + resource-exhaustion). Defaults to false. |
compliance_reportGenerate a website compliance report — the same automated assessment the ScanLabsAI agency portal runs — covering GDPR/CCPA privacy, WCAG 2.1 AA accessibility, PCI DSS 4.0 payment security and general standards. Returns an overall score, per-category scores and the failing/at-risk checks with recom…Generate a website compliance report — the same automated assessment the ScanLabsAI agency portal runs — covering GDPR/CCPA privacy, WCAG 2.1 AA accessibility, PCI DSS 4.0 payment security and general standards. Returns an overall score, per-category scores and the failing/at-risk checks with recom…
url: Links to undeclared domain: example.com| Parameter | Type | Description |
|---|---|---|
| url* | string | The website URL to assess for compliance, e.g. https://example.com |
get_fix_guidanceGet detailed, step-by-step remediation guidance for a specific vulnerability or security issue (e.g. "missing Content-Security-Policy header", "SQL injection", a CVE id). Returns actionable fixes.Get detailed, step-by-step remediation guidance for a specific vulnerability or security issue (e.g. "missing Content-Security-Policy header", "SQL injection", a CVE id). Returns actionable fixes.
| Parameter | Type | Description |
|---|---|---|
| issue* | string | The vulnerability, finding title, or CVE id to fix. |
lookup_cvesLook up recent CVEs from the NIST NVD feed, optionally filtered by keyword. Returns id, severity, score and summary.Look up recent CVEs from the NIST NVD feed, optionally filtered by keyword. Returns id, severity, score and summary.
| Parameter | Type | Description |
|---|---|---|
| keyword | string | Optional keyword, e.g. "wordpress" or "openssl". |
| limit | number | Max results (1-25). Defaults to 10. |
get_pricingGet ScanLabsAI pricing: the free-first-scan policy and AI credit packs.Get ScanLabsAI pricing: the free-first-scan policy and AI credit packs.
No input schema was published for this tool.
check_creditsCheck the signed-in account's AI credit balance. Requires a ScanLabsAI API key in the MCP connection (Authorization: Bearer slai_...). Create one at https://scanlabsai.com/mcp.Check the signed-in account's AI credit balance. Requires a ScanLabsAI API key in the MCP connection (Authorization: Bearer slai_...). Create one at https://scanlabsai.com/mcp.
No input schema was published for this tool.
buy_creditsGet a secure Stripe checkout link to buy an AI credit pack for the signed-in account. Requires a ScanLabsAI API key in the MCP connection. Credits are added automatically once payment completes. Packs: starter (5), pro (15), agency (50).Get a secure Stripe checkout link to buy an AI credit pack for the signed-in account. Requires a ScanLabsAI API key in the MCP connection. Credits are added automatically once payment completes. Packs: starter (5), pro (15), agency (50).
| Parameter | Type | Description |
|---|---|---|
| pack | string | Pack id: starter, pro, or agency. Defaults to pro. |
8 of 8 tools published a description.
Tool names and descriptions are written by the publisher and shown verbatim as inert text. They are the strings an MCP client passes to a model, so Forge scans them for prompt-injection patterns — any finding appears with the security scan above. “Privileged” is a keyword match on the tool name, not an audit of what the tool does: a benign-sounding name can still do anything.
Scan a website for vulnerabilities: OWASP Top 10, CVEs, SSL, headers - with plain-English fixes
Linked names open Forge’s index of every entry observed exposing that tool. Browse all indexed tools.
This entry publishes no npm package, so Forge has no dependency tree for it. That is a gap in coverage — not a statement that it has no dependencies.