Cyber Lens AI MCP Server

Security scanning for AI assistants and agentic coding workflows.

A Model Context Protocol (MCP) server that gives AI assistants the ability to scan websites, public repositories, and Open CLAW skills for security vulnerabilities. It's purpose-built for the agentic coding era, with native support for scanning skill packages before you install them.

What It Does

When connected to an AI assistant (Claude Desktop, VS Code, etc.), this MCP server adds security scanning tools that the assistant can use during your conversation:

• Scan a CLAW skill before installing it -- the server downloads the skill package, extracts it, and analyses the actual source code for dangerous patterns, hardcoded secrets, and permission issues
• Scan a website in a local quick mode without an account, or use the full cloud scan when connected
• Scan a public repository for exposed secrets, dependency vulnerabilities, suspicious code patterns, and trust posture issues
• Check your remaining cloud scan quota before kicking off a batch of scans
• Get remediation guidance with step-by-step fix instructions and code examples

Example Conversation

You:    "I want to install this skill: https://clawhub.ai/skills/ontology"

Claude: I'll scan it for security issues first.

        [PASS] CLAW Skill Security Scan: ontology v1.0.4

        Security Score: 95/100
        Files Analyzed: 5

        Skill appears safe to install. Minor issues noted below.

        1. [MEDIUM] File write operation
           File: scripts/ontology.py:399
           Fix: Ensure file writes are limited to expected directories.

        The skill looks safe. It writes to the filesystem for its knowledge
        graph storage, which is expected behaviour for this type of skill.

Getting Started

1. Install

After the first npm release, the recommended install path is:

npx -y @shadoprizm/cyberlens-mcp-server

Before that, or for local development and manual builds:

git clone https://github.com/shadoprizm/cyberlens-mcp-server.git
cd cyberlens-mcp-server
npm install
npm run build

2. Add to Your AI Assistant

Claude Desktop -- add to ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):

{
  "mcpServers": {
    "cyberlens": {
      "command": "npx",
      "args": ["-y", "@shadoprizm/cyberlens-mcp-server"]
    }
  }
}

If you are running from a source checkout instead of npm:

{
  "mcpServers": {
    "cyberlens": {
      "command": "node",
      "args": ["/absolute/path/to/cyberlens-mcp-server/dist/index.js"]
    }
  }
}

Claude Code -- add to your MCP settings or project configuration.

VS Code (Copilot/Continue) -- configure per your extension's MCP server settings.

3. Connect Your Account

Website tools work immediately without an account in local quick mode. That local mode covers roughly 15 core checks and returns results right away.

Connecting an account upgrades website scans to the full CyberLens cloud path with 70+ checks, scan history, and AI analysis. Repository and account-only tools still connect through the browser flow when needed.

When a repository or account-only tool needs an account, the MCP server:

1. opens the CyberLens browser flow automatically
2. sends the user to cyberlensai.com to sign up or log in
3. receives the secure callback locally
4. saves the API key to ~/.cyberlens/mcp/config.json
5. continues the original

... View full README on GitHub