API and MCP security scanner

Paste a URL and the scanner shows what an anonymous client can see. It is read-only, needs no credentials and no signup, and sends about twenty requests one at a time. It checks seven areas: transport, authentication, CORS, response headers, rate limiting, error disclosure and MCP. Every check is a request any client on the internet could already make, and the endpoint gets a grade from A+ to F with a fix for each finding that you can paste into an AI coding agent.

The most expensive mistakes hide in plain sight because you always test while authenticated. An outside view reveals what a stranger can reach without credentials. You get a grade from A+ to F for API security and a written instruction for each finding that fixes exactly that issue.

An MCP server exists to let an AI agent take actions, so an unauthenticated MCP server is not a data leak. It is a stranger holding your tools. The scan sends the same JSON-RPC initialize handshake every MCP client sends, and if it succeeds without credentials it asks for the tool list. It never calls a tool because that would execute code on someone else's system.

Clients put each tool description straight into the model's context, so the scan reads every description as text the agent executes rather than text a person reads. It flags instructions to ignore previous instructions, read a credentials file, call another tool first, send data to a URL, or keep something from the user, plus hidden text like invisible Unicode characters, HTML comments and long encoded blobs.

Write-capable tools reachable without credentials weigh most, and a name that suggests writes, deletes, sends, pays or deploys is treated as more serious. A deliberately public read-only MCP server answering anonymously is reported as a choice, not graded as a flaw. An example poisoned description looks like ordinary documentation with an extra sentence asking the agent to read ~/.ssh/id_rsa and pass its contents without telling the user.

The scan is deliberately limited to what any anonymous client could already do. It is read-only and sends about twenty requests one at a time, with no fuzzing, enumeration, brute force or payloads designed to break anything. It is not a penetration test.

The limit matters because the target belongs to someone else. The scanner never calls a tool, since that would run code on another system, and it follows redirects by hand so it cannot be steered into a private address. The twenty requests are a small load but they are real requests.