compuute-scan-api

{
  "name": "compuute-scan-api",
  "description": "MCP-specific static security scanner for agents. Scan any public GitHub MCP-server repo and get severity counts, score, top findings, and a triage disclaimer. 37 L1 rules across TS/JS, Python, Go, Rust, C#, Java, Kotlin. Threat-intel response cadence: new rules added within one week of published CVE classes (see compuute-scan v0.6.2's L1-038 for the Ox Security npx-argument-injection vector).",
  "url": "https://scan.compuute.se",
  "version": "0.3.0",
  "documentationUrl": "https://scan.compuute.se/docs",
  "mcpEndpoint": "https://scan.compuute.se/mcp/",
  "provider": {
    "organization": "Compuute AB",
    "url": "https://compuute.se"
  },
  "capabilities": {
    "streaming": false,
    "pushNotifications": false,
    "stateTransitionHistory": false,
    "multiTurn": false
  },
  "authentication": {
    "schemes": [
      "none",
      "x402"
    ],
    "x402Endpoint": "https://scan.compuute.se/v1/scan/pay",
    "freeEndpoint": "https://scan.compuute.se/v1/scan"
  },
  "skills": [
    {
      "id": "scan_mcp_server",
      "name": "Scan MCP server repo",
      "description": "Clone a public GitHub MCP-server repo and run compuute-scan L0+L1 static analysis. Returns severity counts, 0-100 score, 10 most severe findings, performance metrics, and a triage disclaimer. Median latency 1-2s for small repos.",
      "tags": [
        "security",
        "mcp",
        "static-analysis",
        "supply-chain",
        "cve"
      ],
      "inputModes": [
        "application/json"
      ],
      "outputModes": [
        "application/json"
      ],
      "examples": [
        {
          "description": "Scan an MCP server you're evaluating",
          "input": {
            "repo_url": "https://github.com/modelcontextprotocol/servers"
          }
        }
      ]
    }
  ],
  "pricing": {
    "free": "0 USDC \u2014 POST /v1/scan, no API key, rate-limited",
    "perScan": "$0.10 USDC on Base L2 \u2014 POST /v1/scan/pay with X-Payment header",
    "manualAudit": "$5K-30K \u2014 see https://compuute.se/audit"
  },
  "agentSafety": {
    "honestFraming": "Every response carries a _disclaimer field stating that findings are pattern matches, not exploitability claims. Static analysis cannot determine whether vulnerable code paths are reachable from attacker-controlled input.",
    "noCodeExecution": "compuute-scan never executes code from the scanned repo. Files are read as text and pattern-matched against regex rules.",
    "sandboxing": "Clones live in tempfile.TemporaryDirectory() and are wiped after each scan. git clone uses --depth 1 --filter=blob:limit=10m with a 60s timeout.",
    "dataMinimization": "No scan results stored server-side. Stateless service.",
    "openSource": "Scanner source: https://github.com/Compuute/compuute-scan (MIT). API source: https://github.com/Compuute/compuute-scan-api (MIT)."
  }
}