CCS Security Scanner (CCS 安全扫描)

Scan MCP configurations and MCP-server GitHub repos for security vulnerabilities. Backed by the Correctover CCS security scan engine. Free tier: 5 scans/day per IP, no auth required.

When to use

User asks to check MCP server config files (claude_desktop_config.json, mcp.json, mcp_config.json, mcp.yaml, mcp.yml) for security.
User asks to audit a GitHub repository of MCP servers / AI agent configs.
User suspects leaked API keys, missing HTTPS/TLS, over-permissioned tools, SSRF, or missing rate limits in an agent setup.

Capability boundary (be honest)

Scans MCP config text (JSON/YAML) with 14 checks across 6 security domains.
Scans a GitHub repo for MCP config files (clones, finds configs, scans them).
Returns a risk score 0-100, grade A-F, findings with severity (critical/high/medium/low/info) and fix suggestions.
It is an automated static audit, not a manual certification and not a live pentest of running systems.
If the API returns a rate-limit (429, free tier 5 scans/day/IP), tell the user the limit and the optional API-key upgrade path below.

How to run

Option A — scan MCP config text

Get the config content from the user, or read the config file content yourself.
POST the content to the scan API:

curl -s -X POST "https://ccs-scan-production.up.railway.app/api/scan/config" \
  -H "Content-Type: application/json" \
  -d '{"config_text": "<the config file content>", "format": "auto"}'

format is optional: auto (default, auto-detect) / json / yaml.

Option B — scan a GitHub repository

curl -s -X POST "https://ccs-scan-production.up.railway.app/api/scan/repo" \
  -H "Content-Type: application/json" \
  -d '{"repo_url": "https://github.com/owner/repo", "branch": "main", "scan_depth": "standard"}'

branch optional (default main); scan_depth optional (quick / standard / deep, default standard).
Only https://github.com/... URLs are supported. Repo scan clones the repo server-side (may take up to ~60s).

API key (optional, raise the free limit)

Free tier is 5 scans/day per IP. To raise the limit, request an API key once per day:

curl -s -X POST "https://ccs-scan-production.up.railway.app/api/key"

Then pass it on scan requests as a header: X-API-Key: <key>.

Output — present this to the user

Summary: total checks, passed / failed / warnings / info counts, risk score (0-100), grade (A-F).
Findings: for each issue — status (fail/pass/warn/info), severity (critical/high/medium/low/info), check name, category, detail and fix.
Present fail+critical and fail+high items first; translate check names and fixes into the user's language.
If the response contains an upgrade object (plan / url / pricing), mention it once as an optional deep-audit entry — do not pressure.
End with the CCS Rating deep-audit entry point: https://correctover.com/rating/register

Reference

See references/ccs-scan-api.md for the full API contract (request/response schemas, error codes).