Compuute MCP Security Scanner

https://server.smithery.ai/daniel-abbay/compuute-scan-api/mcp

● healthy

Static security scanner for MCP servers. POST a public GitHub URL, get severity counts, a score, and the top findings with file+line back. 37 rules across TypeScript, JavaScript, Python, Go, Rust, C#, Java, and Kotlin — every language with an official MCP SDK. Detects argument injection for npx/uvx/pipx/pnpx runner binaries (CWE-88), known CVEs in 40+ top packages, and the usual L0 discovery (transport, tool inventory, dependency pinning). This is a pattern detector, not an exploitability oracle. Around 90% raw false-positive rate on unfiltered output — triage is on you, and the response says so explicitly. POST /v1/scan is free with no API key. POST /v1/scan/pay charges $0.10 USDC per scan via x402 on Base. Manual L2-L4 audits at compuute.se/audit when you need dataflow review. Wraps compuute-scan (MIT, zero deps). Per-rule false-positive rates and the methodology paper live in the repo.

Transport

streamable-http

Auth

smithery_api_key

Cost

—

Protocol revision

2025-11-25

negotiated, not declared

MCP readiness

B · 81/100

Readiness is how fully this listing follows its protocol and how it behaved in our probes over 30 days. It is shown for reference and does not move it in search. Search order and leaderboards use the separate quality grade (here C+, 70.0/100), which weighs availability, conformance, p95 speed and descriptor. How the two differ

Valid MCP handshake	10/10	initialize and tools/list both answered.
Live MCP endpoint	24/25	Endpoint answers the MCP initialize handshake (2773 ms); slow response -1.
Protocol revision	8/10	Speaks MCP 2025-11-25, 1 revision(s) behind 2026-07-28.
Signed descriptor	n/a	No MCP standard defines a signed server descriptor.
Uptime (30 days)	15/15	30/30 probes succeeded over 30 days (100%).
Tool declaration	5/10	Lists 1 tool(s) with descriptions.
Verified identity	5/10	Publisher declared (repository, package or homepage); claim this listing to verify domain control.
Freshness + modern flags	4/5	seen in a source within 7 days.
Auth declaration	2/5	Declares credential scheme: smithery_api_key.

Applicable criteria total 90 points, scaled to 100.

Responsiveness: Slow (2773 ms; bands ≤2.5 s, ≤5 s, ≤8 s, slower; penalty only).

Measured 2026-11-11.

Nine criteria, the same as the A2A readiness score, read from our daily MCP probe (initialize + tools/list) and 30-day probe history. No MCP standard defines a signed server descriptor, so that criterion is n/a and the other 90 points are scaled to 100. Grades: A>=90, B>=75, C>=60, D>=40, F<40. Display only: search order uses the quality grade.

Compared with peers

Against 53,021 reachable MCP servers in our daily snapshot (2026-11-12 01:39 UTC). Display only; it does not change search order.

Readiness: Higher than 52% of peers; This listing 81 · peer median 81
Latency: Faster than 12% of peers; This listing 817 ms · peer median 326 ms

Where it loses the most points, and how to win them back

Tool declaration −5 — Declare every tool with a description and input schema.
Now: Lists 1 tool(s) with descriptions.
Verified identity −5 — Claim the listing and prove control of its domain.
Now: Publisher declared (repository, package or homepage); claim this listing to verify domain control.
Auth declaration −3 — State how to authenticate (an auth scheme, or that none is needed).
Now: Declares credential scheme: smithery_api_key.

How many agent tools actually work · All statistics

Listed in

Directories this entry was found in.

smithery since 2026-06-04 ↗

How to connect

MCP endpoint (streamable-http)

https://server.smithery.ai/daniel-abbay/compuute-scan-api/mcp

JSON-RPC initialize probe

curl -X POST https://server.smithery.ai/daniel-abbay/compuute-scan-api/mcp \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{}}'

Homepage

https://scan.compuute.se

Listed at (smithery)

https://scan.compuute.se