{"name":"compuute-scan-api","description":"MCP-specific static security scanner for agents. Scan any public GitHub MCP-server repo and get severity counts, score, top findings, and a triage disclaimer. 37 L1 rules across TS/JS, Python, Go, Rust, C#, Java, Kotlin. Threat-intel response cadence: new rules added within one week of published CVE classes (see compuute-scan v0.6.2's L1-038 for the Ox Security npx-argument-injection vector).","url":"https://scan.compuute.se","version":"0.3.0","documentationUrl":"https://scan.compuute.se/docs","mcpEndpoint":"https://scan.compuute.se/mcp/","provider":{"organization":"Compuute AB","url":"https://compuute.se"},"capabilities":{"streaming":false,"pushNotifications":false,"stateTransitionHistory":false,"multiTurn":false},"authentication":{"schemes":["none","x402"],"x402Endpoint":"https://scan.compuute.se/v1/scan/pay","freeEndpoint":"https://scan.compuute.se/v1/scan"},"skills":[{"id":"scan_mcp_server","name":"Scan MCP server repo","description":"Clone a public GitHub MCP-server repo and run compuute-scan L0+L1 static analysis. Returns severity counts, 0-100 score, 10 most severe findings, performance metrics, and a triage disclaimer. Median latency 1-2s for small repos.","tags":["security","mcp","static-analysis","supply-chain","cve"],"inputModes":["application/json"],"outputModes":["application/json"],"examples":[{"description":"Scan an MCP server you're evaluating","input":{"repo_url":"https://github.com/modelcontextprotocol/servers"}}]}],"pricing":{"free":"0 USDC — POST /v1/scan, no API key, rate-limited","perScan":"$0.10 USDC on Base L2 — POST /v1/scan/pay with X-Payment header","manualAudit":"$5K-30K — see https://compuute.se/audit"},"agentSafety":{"honestFraming":"Every response carries a _disclaimer field stating that findings are pattern matches, not exploitability claims. Static analysis cannot determine whether vulnerable code paths are reachable from attacker-controlled input.","noCodeExecution":"compuute-scan never executes code from the scanned repo. Files are read as text and pattern-matched against regex rules.","sandboxing":"Clones live in tempfile.TemporaryDirectory() and are wiped after each scan. git clone uses --depth 1 --filter=blob:limit=10m with a 60s timeout.","dataMinimization":"No scan results stored server-side. Stateless service.","openSource":"Scanner source: https://github.com/Compuute/compuute-scan (MIT). API source: https://github.com/Compuute/compuute-scan-api (MIT)."}}