MCP Server
Guides
MCP Server
Give your AI assistant Scanverra's scanners. Agents can audit a page, scan a site's security, analyse SEO and AI search readiness, scan a connected repository and review MCP configuration, then read structured results and link you to the full report.
Beta. Scans started from an AI assistant are ordinary Scanverra scans: they appear in your scan history and count toward your plan once, like scans from the website, CLI or CI. The MCP server is part of the Enterprise plan.
Connect your client
Scanverra runs a remote MCP server over Streamable HTTP. Your client sends an API key with each request.
- Create an API key on the API keys page. Use Full access to start scans, or Read only to let the assistant read reports without starting new ones.
- Store the key in an environment variable or your client's secret prompt, not in a file you commit.
- Add the server to your client with one of the snippets below, then restart or reload its MCP servers.
Endpoint
https://www.scanverra.com/api/mcp
# Claude.ai and Claude Desktop: Settings > Connectors > Add custom connector # ChatGPT: Settings > Connectors > Create (developer mode) URL: https://www.scanverra.com/api/mcp Auth: OAuth (sign in to Scanverra and approve when asked)
ChatGPT, Claude.ai and Claude Desktop connect with OAuth: add the endpoint as a custom connector, sign in to Scanverra and approve. Each approved app is listed on the MCP Server page, where you can disconnect it.
How it works
Same scans, same reports
Each tool calls the same Scanverra scan you would start from the website, with your plan's limits, history and report links.
Scans run in the background
A scan tool returns a scan ID straight away. The assistant checks the matching report tool until the scan is done, usually within two minutes.
Structured results
Every report has a score, severity counts, the most severe findings with fixes, and a link to the full report.
Scoped access
The assistant only sees the tools your key allows. Read only keys can't start scans, and nobody can read another account's reports.
Tools
Your client lists these automatically, with input and output schemas.
| Tool | Type | What it does |
|---|---|---|
scan_website | Starts a scan | Audit a page: performance on desktop and mobile, SEO, accessibility, best practices and AI agent readiness. |
get_website_report | Read | Scores and the top issues of an audit, optionally for one category. |
compare_website_scans | Read | Score changes, fixed issues and new issues between two audits. |
scan_browser | Starts a scan | Load the page in a real browser and record JavaScript errors, broken links, form, image and accessibility issues. |
get_browser_report | Read | Health score and problems found by a browser audit. |
analyze_seo | Starts a scan | SEO scan of a page, with an optional keyword and competitor page. |
get_seo_report | Read | SEO score and findings with recommendations. |
analyze_ai_search | Live check | llms.txt and which AI crawlers your robots.txt allows. No quota used. |
analyze_meta_tags | Live check | Title, description, headings, canonical and Open Graph tags. No quota used. |
scan_website_security | Starts a scan | Passive security scan: HTTPS and TLS, headers, cookies, exposed files, client-side secrets, vulnerable libraries and DNS. |
get_security_report | Read | Security score, findings with evidence and fixes, headers and TLS details. |
check_tls_configuration | Live check | Certificate, chain, TLS version and HSTS. No quota used. |
check_content_security_policy | Live check | Evaluates the page's Content Security Policy. No quota used. |
scan_repository | Starts a scan | Scan a repository connected to your account for secrets, code security, vulnerable dependencies, quality and AI security. |
get_repository_report | Read | Repository score and findings with file and line, optionally for one category. |
scan_mcp_config | Live check | Review MCP and AI agent config files the assistant reads from your project. Nothing is stored. No quota used. |
check_security_headers | Live check | Response headers and cookie flags of one page, checked with the Security Scan's rules. No quota used. |
scan_mcp_server | Live check | Read-only probe of a remote MCP server you own: transport, authentication, OAuth discovery and tool descriptions. Never calls a tool. |
get_mcp_security_report | Read | A saved MCP server probe. |
compare_mcp_posture | Read | Risk change and fixed or new findings between two probes of a server. |
discover_mcp_servers | Read | MCP servers you probed and those configured in your scanned repositories. |
explain_finding | Read | Everything about one finding: evidence, impact, fix and CWE. |
create_remediation_plan | Read | An ordered fix plan for a finished scan: now, next and later. |
get_fix_prompt | Read | Scanverra's fix prompt for your coding agent. |
verify_remediation | Starts a scan | Re-run a scan on the same target to check your fixes. |
compare_scans | Read | Score change, fixed and new findings between two scans of any tool. |
get_account | Read | Your plan, and your scans this month and in total. |
list_scans | Read | Your past scans, filtered by tool, site, status and date. |
get_scan_stats | Read | How many scans you have, by tool and outcome, for any period or site. |
Ready-made prompts
website_health_assessmentwebsite_seo_optimizationwebsite_security_assessmentrepository_security_reviewmcp_security_reviewai_agent_security_reviewwebsite_remediation_workflowSecurity
- Only scan sites and repositories you own or are authorised to test. Website scans are passive.
- Report content (page text, file contents, tool descriptions) is untrusted data. The server tells your assistant never to follow instructions found in it.
- Your key is never returned in results or written to logs. Secrets found by a scan are masked in results.
- Config files sent to scan_mcp_config are analysed in memory and never stored.
- Private, local and cloud metadata addresses are refused before any scan starts.
Troubleshooting
| Message | Fix |
|---|---|
401 Missing Scanverra API key | The key wasn't sent. Check the environment variable is set where your client runs, and use the www.scanverra.com address. |
401 not valid, has expired or was revoked | Create a new key on the API keys page. |
403 part of the Enterprise plan | The MCP server is part of the Enterprise plan. See plans and contact us to upgrade. |
Only get_ tools are listed | The key is Read only. Use a Full access key to start scans. |
plan_limit | This month's free scans are used. Upgrade or wait for the new month. |
email_verification_required | Confirm your email address, then try again. |
target_unreachable | The site didn't answer, or it points to a private address. |
Ready to connect?
Create an API key, add the server to your client and ask your assistant to audit a page.