compuute-scan-api

{
  "protocolVersion": "1.0",
  "name": "compuute-scan-api",
  "description": "MCP-specific static security scanner for agents. Scan any public GitHub MCP-server repo and get severity counts, score, top findings, and a triage disclaimer. 38 L1 rules across TS/JS, Python, Go, Rust, C#, Java, Kotlin. Threat-intel response cadence: new rules added within one week of published CVE classes (see compuute-scan v0.6.2's L1-038 for the Ox Security npx-argument-injection vector).",
  "version": "0.5.0",
  "documentationUrl": "https://scan.compuute.se/docs",
  "supportedInterfaces": [
    {
      "url": "https://scan.compuute.se/mcp/",
      "protocolBinding": "https://modelcontextprotocol.io/streamable-http",
      "protocolVersion": "2025-06-18"
    },
    {
      "url": "https://scan.compuute.se/v1/scan",
      "protocolBinding": "https://spec.openapis.org/oas/v3.1",
      "protocolVersion": "3.1"
    }
  ],
  "mcpEndpoint": "https://scan.compuute.se/mcp/",
  "provider": {
    "organization": "Compuute AB",
    "url": "https://compuute.se"
  },
  "capabilities": {
    "streaming": false,
    "pushNotifications": false,
    "extendedAgentCard": false
  },
  "skills": [
    {
      "id": "scan_mcp_server",
      "name": "Scan MCP server repo",
      "description": "Clone a public GitHub MCP-server repo and run compuute-scan L0+L1 static analysis. Returns severity counts, 0-100 score, 10 most severe findings, performance metrics, and a triage disclaimer. Median latency 1-2s for small repos.",
      "tags": [
        "security",
        "mcp",
        "static-analysis",
        "supply-chain",
        "cve"
      ],
      "inputModes": [
        "application/json"
      ],
      "outputModes": [
        "application/json"
      ],
      "examples": [
        "Scan {\"repo_url\": \"https://github.com/modelcontextprotocol/servers\"} before connecting an agent to it"
      ]
    }
  ],
  "pricing": {
    "free": "0 USDC \u2014 POST /v1/scan, no API key, rate-limited",
    "perScan": "$0.10 USDC on Base L2 \u2014 POST /v1/scan/pay with X-Payment header",
    "manualAudit": "$5K-30K \u2014 see https://compuute.se/audit"
  },
  "payments": {
    "protocol": "x402",
    "x402Version": 2,
    "paidEndpoint": "https://scan.compuute.se/v1/scan/pay",
    "freeEndpoint": "https://scan.compuute.se/v1/scan",
    "manifest": "https://scan.compuute.se/.well-known/x402.json"
  },
  "agentSafety": {
    "honestFraming": "Every response carries a _disclaimer field stating that findings are pattern matches, not exploitability claims. Static analysis cannot determine whether vulnerable code paths are reachable from attacker-controlled input.",
    "noCodeExecution": "compuute-scan never executes code from the scanned repo. Files are read as text and pattern-matched against regex rules.",
    "sandboxing": "Clones live in tempfile.TemporaryDirectory() and are wiped after each scan. git clone uses --depth 1 --filter=blob:limit=10m with a 60s timeout.",
    "dataMinimization": "No scan results stored server-side. Stateless service.",
    "openSource": "Scanner source: https://github.com/Compuute/compuute-scan (MIT). API source: https://github.com/Compuute/compuute-scan-api (MIT)."
  }
}