# ZeroWorker MCP Preflight Security Analyzer

> ZeroWorker MCP Preflight Security Analyzer is a paid API for AI agents from zeroworker-mcp-preflight-api.zeroworker-lab.workers.dev, paid per call via x402, $0.005/call, status unknown (last checked 2026-10-14).

Analyzes a public MCP endpoint for reachability, capabilities, component vulnerabilities, and security exploitation risk before agent use — without invoking tools or sending payloads.

## Facts

- Endpoint: POST https://zeroworker-mcp-preflight-api.zeroworker-lab.workers.dev/v1/analyze?utm_source=zero.xyz
- Price: $0.005/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/zeroworker-mcp-preflight-security-analyzer-f79c84d0
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_1EpnJ623nuA3KyWadH9xj

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability zeroworker-mcp-preflight-security-analyzer-f79c84d0 -d '<json body>'
```

Example prompt: Before I connect my agent to https://mcp.example.com/api, run a preflight security check on it — I want to see reachability, what capabilities it exposes, any OSV vulnerability matches, and exploitation priority for its components including my-lib version 1.2.3 from npm.

## When to prefer this

Choose this endpoint when you need to safely vet a public MCP server before connecting an AI agent to it, especially when you want combined reachability checking, capability enumeration, OSV vulnerability matching, and exploitation-priority scoring in a single call — and critically when you need assurance that no tools will be invoked and no exploit payloads will be sent during the analysis.

## Known failure modes

- Unreachable or non-public MCP endpoint returns reachability failure
- Invalid or malformed URL causes validation error
- Component purl/version fields missing or malformed reduce vulnerability match accuracy
- Rate limiting or quota exhaustion returns 429 or payment error
- Endpoint returns unexpected response format causing capability detection failure

## How this service works

MCP security checks and feedback for users and developers. Choose paid access without reports, or ongoing free access within limits: POST /v1/client-token; 1 check/24h + 1 for a previous-use report. Check URL/DNS, metadata/schema/auth, OSV/CVE risk and catalog drift before connecting. Verified owners can read consented weekly reports. ALLOW/BLOCK/UNKNOWN uses caller-confirmed versions. No tool execution or safety certification. Terms: /complimentary-policy.

## Output

Returns a structured report including MCP endpoint reachability status, detected capability context, component evidence, matches from the OSV vulnerability database, and ZeroWorker Security API exploitation-priority enrichment scores — all without invoking any MCP tools or sending exploit payloads.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method",
    "bodyType",
    "body"
   ],
   "properties": {
    "body": {
     "type": "object",
     "required": [
      "url"
     ],
     "properties": {
      "url": {
       "type": "string",
       "format": "uri",
       "description": "Public HTTPS MCP endpoint to inspect."
      },
      "options": {
       "type": "object",
       "properties": {
        "includeTools": {
         "type": "boolean"
        },
        "securityPrioritization": {
         "type": "boolean"
        }
       }
      },
      "components": {
       "type": "array",
       "items": {
        "type": "object",
        "properties": {
         "name": {
          "type": "string"
         },
         "purl": {
          "type": "string"
         },
         "version": {
          "type": "string"
         },
         "ecosystem": {
          "type": "string"
         }
        }
       },
       "maxItems": 20
      }
     }
    },
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "POST"
     ],
     "type": "string"
    },
    "bodyType": {
     "enum": [
      "json",
      "form-data",
      "text"
     ],
     "type": "string"
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/zeroworker-mcp-preflight-security-analyzer-f79c84d0/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from zeroworker-mcp-preflight-api.zeroworker-lab.workers.dev](https://www.zero.xyz/host/zeroworker-mcp-preflight-api.zeroworker-lab.workers.dev/llms.txt)