# API and MCP Security Scanner

> Point it at an API or MCP endpoint and see what it gives a stranger with no credentials, graded A+ to F with a fix for every finding.

Canonical URL: https://www.startuphub.ai/api-security
Free to use: yes. Publisher: StartupHub.ai

## What it offers

- Checks seven areas covering transport, authentication, CORS, response headers, rate limiting, error disclosure and MCP.
- On an MCP server it sends the JSON-RPC initialize handshake and lists tools that answer with no credentials without ever calling a tool.
- Reads every MCP tool description for injection including "ignore previous instructions", credential reads, chained calls, URL exfiltration, hidden actions, hidden Unicode, HTML comments and long encoded blobs.
- Each finding includes a paste-ready fix tailored for an AI coding agent.

## Why it is different

- It is read-only and sends about twenty requests one at a time with no fuzzing, brute force or attack payloads.
- Redirects are followed by hand, so the scan cannot be steered to a private address.
- The grade is a weighted ratio of only the checks that could be scored and checks that could not be measured are shown but not scored.
- Write-capable tools reachable without credentials weigh most and a deliberately public read-only MCP server is reported as a choice, not a flaw.

## How to use it

1. Enter an endpoint, for example https://api.example.com/v1/users or an MCP server URL.
2. Run the scan and wait a few seconds, longer if a rate limit must be observed.
3. Read the A+ to F grade and the findings in each of the seven areas.
4. Copy each fix into your coding agent and scan again.

## Inputs and outputs

- Inputs: A public URL or hostname of an API or MCP server, up to 400 characters.
- Outputs: An A+ to F grade, findings per area with a fix for each and, on an MCP server, the list of tools reachable without credentials.

## Limits and plans

- Without signup, no credentials are needed and scans are limited to up to 10 scans a day from one network.
- On the Free plan, the scanner allows 3 security scans a month, while every paid plan is unlimited.
- With StartupHub Monitor on Pro Lite and above, an endpoint can be rescanned every hour and a check that stops passing is reported.
- Plans and prices: https://www.startuphub.ai/pricing

## API and MCP

No public API for this tool. Use it at https://www.startuphub.ai/api-security.

## Related tools

- [AI Agent Readiness](https://www.startuphub.ai/agent-readiness): Paste a website, REST API or MCP endpoint and get a 0 to 100 score for AI agent readiness, a letter grade, and a fix prompt for every failed check.
- [Tech Stack Checker](https://www.startuphub.ai/tech-stack): Paste a URL to see the hosting, frameworks, analytics, payments, auth and DNS behind any site linked to the company that runs it.
- [Monitor](https://www.startuphub.ai/monitor): Watch any company by its domain and get one digest of what changed, only when something changed, by email, Slack or Teams.
- [All free tools](https://www.startuphub.ai/free-tools)