# MCP Server Security Scanner (SYNTHORA mcpscan)

> MCP Server Security Scanner (SYNTHORA mcpscan) is a paid API for AI agents from mcpscan.hergertsynthora.com, paid per call via x402, $0.05/call, status unknown (last checked 2026-09-14).

Probes an MCP server and runs a deterministic rule engine to detect secrets, dangerous capabilities, prompt injection, and misconfigurations, returning a security score and structured findings

## Facts

- Endpoint: POST https://mcpscan.hergertsynthora.com/service
- Price: $0.05/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/mcp-server-security-scanner-synthora-mcpscan-ee583c94
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_8YMQ2y4BPKNCW40YEzmCJ

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability mcp-server-security-scanner-synthora-mcpscan-ee583c94 -d '<json body>'
```

Example prompt: Can you security-scan the MCP server at https://myserver.example.com/mcp — I want to know if it has any embedded secrets, dangerous shell capabilities, or prompt injection risks before I let my agent connect to it?

## When to prefer this

Use this endpoint when you need to vet an MCP server before connecting an AI agent to it — especially when evaluating third-party or community MCP servers. Prefer this over manual review when you need a deterministic, rule-based (zero-LLM) security score with cryptographically signed results. Ideal for agent orchestration pipelines that need automated trust gating before tool registration.

## Known failure modes

- MCP server URL unreachable or returns non-JSON-RPC response
- Provided manifest missing required serverInfo or tools fields
- Invalid URL format in request body
- MCP server times out during JSON-RPC initialize probe
- Payment not completed (x402 402 response returned before scan executes)

## How this service works

MCP Server Security Scan: probes an MCP server (JSON-RPC initialize + tools/list) and applies a deterministic rule engine over its tools — embedded secrets, dangerous shell/exec/filesystem capabilities, prompt-injection surface, hidden unicode, permissive input schemas, and auth/TLS/CORS headers — returning a security_score + findings[]. The trust layer for the agent economy. Zero-LLM, Ed25519-signed. 0.05 USDC via x402 on Base. SYNTHORA.

## Output

Returns a security_score (numeric) and a findings[] array detailing specific issues found: embedded secrets, dangerous shell/exec/filesystem tools, prompt injection surface exposure, hidden unicode, permissive input schemas, and auth/TLS/CORS header misconfigurations. Response is Ed25519-signed for integrity assurance.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "url": {
   "type": "string",
   "description": "MCP server URL (Streamable-HTTP endpoint)"
  },
  "manifest": {
   "type": "object",
   "description": "Or paste the MCP manifest (serverInfo + tools) directly"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "ok": true,
  "niche": "mcp_scan",
  "result": {
   "counts": {
    "low": 0,
    "high": 2,
    "medium": 2,
    "critical": 1
   },
   "signed": "ed25519",
   "target": "https://mcp.example.dev/mcp",
   "verdict": "critico",
   "findings": [
    {
     "id": "MCP-S01",
     "rule": "secret_in_manifest",
     "tool": "read_file",
     "detail": "openai_key embedded in tool",
     "severity": "critical"
    }
   ],
   "tools_scanned": 2,
   "security_score": 14
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/mcp-server-security-scanner-synthora-mcpscan-ee583c94/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from mcpscan.hergertsynthora.com](https://www.zero.xyz/host/mcpscan.hergertsynthora.com/llms.txt)