compuute-scan-api

Scan-as-a-Service for MCP servers. HTTP + MCP wrapper around compuute-scan — the MCP-specific static security scanner. Designed for agent-callable consumption.

POST a public GitHub repo URL → get a structured security report scored against 37 MCP-specific rules across 8 languages (TS/JS, Python, Go, Rust, C#, Java, Kotlin).

Honesty note (read first): compuute-scan is a pattern-breadth detector, not an exploitability oracle. Historic false-positive rate after manual validation is ~90% on raw output (verified against modelcontextprotocol/servers: 138 raw findings → 13 confirmed). Every response carries a _disclaimer field stating this explicitly. Use findings as a triage queue, not as a list of confirmed vulnerabilities. See docs/FP-RATES.md for per-rule transparency.

Live at https://scan.compuute.se. Service version reported by /v1/health.

---

Endpoints

Core scan

Method	Path	Purpose	Auth
POST	/v1/scan	Scan a public GitHub MCP-server repo (free tier, rate-limited)	none
POST	/v1/scan/pay	Same as above via x402 micropayment ($0.10 USDC on Base L2)	X-Payment header
GET	/v1/scan/info	Scanner version + limits + supported ecosystems	none
GET	/v1/health	Liveness + scanner-binary availability	none

Machine-readable contracts

Method	Path	Purpose
GET	/openapi.json	OpenAPI v3 spec with per-field descriptions
GET	/docs	Swagger UI for the OpenAPI spec

MCP server (live)

Endpoint	Tool	Transport
/mcp/	scan_mcp_server(github_url)	Streamable HTTP

Install in Claude Code: claude mcp add compuute-scan --transport http --url https://scan.compuute.se/mcp/

Discovery (/.well-known/)

Path	Format	Consumer
/.well-known/agent.json	A2A Agent Card	Google A2A protocol
/.well-known/agent-card.json	A2A Agent Card (alias)	A2A clients using -card.json naming
/.well-known/ai-plugin.json	OpenAI plugin manifest	ChatGPT / OpenAI tools
/.well-known/x402.json	x402 payment manifest	Coinbase Agent.market crawlers, x402 aggregators
/.well-known/x402	Alias of x402.json	x402 probes without .json suffix
/llms.txt	markdown summary	LLM-driven agent-search crawlers (Exa, Perplexity-style) per llmstxt.org
/robots.txt	crawler policy	search engines
/sitemap.xml	URL index	search engines

Example

curl -X POST https://scan.compuute.se/v1/scan \
  -H 'Content-Type: application/json' \
  -H 'Idempotency-Key: 00000000-0000-0000-0000-000000000001' \
  -d '{"repo_url": "https://github.com/modelcontextprotocol/servers"}'

Response (truncated):

{
  "repo_url": "https://github.com/modelcontextprotocol/servers",
  "scanner": {"name": "compuute-scan", "version": "0.6.2", "layers_covered": ["L0", "L1"]},
  "summary": {"critical": 1, "high": 94, "medium": 22, "low": 0, "files_scanned": 77},
  "score": 0,
  "recommendation": "AVOID — 1 critical and 94 high finding(s)...",
  "top_findings": [...],
  "performance": {"clone_seconds": 1.2, "scan_seconds": 0.5, "repo_size_bytes": 41234},
  "_disclaimer": "PATTERN MATCH — compuute-scan is a static analyzer..."
}

Agent-shaped API features

Feature	How
Idempotent retries (24h cache)	Idempotency-Key header
HTTP cache	ETag + Cache-Control: public, max-age=1800
Conditional GET	If-None-Match → 304 Not Modified
Rate-limit headers	X-RateLimit-Limit/Remaining/Reset
Strict input validation	Pydantic extra="forbid", GitHub-HTTPS-only
OWASP security headers	HSTS / X-Frame-Options / X-Content-Type-Options

... View full README on GitHub