MCP Server ░▒▓

Let your AI agent check a repo for malware before it clones anything. The scanrepo-mcp package exposes ScanRepo over the Model Context Protocol, so agents can scan, get a verdict and read findings over stdio.

What It Exposes ░▒▓

scan_repo

Scan any GitHub or Bitbucket URL. Returns a 0–100 risk score, a verdict and the full list of findings — the same report you see on the scan page.

repo_verdict

Fast cached verdict for an owner/repo pair. Use it when the agent only needs a quick safe / suspicious / dangerous answer.

recent_scans

Latest community scans, with tabs for recent, most-scanned, dangerous and AI finds — a live feed of what the scanner is catching.

Install ░▒▓

Claude Code

One command registers the server, run on demand via npx:

$ claude mcp add scanrepo -- npx -y scanrepo-mcp

Claude Desktop / Cursor

Add it to your MCP config file (claude_desktop_config.json or Cursor settings):

{
  "mcpServers": {
    "scanrepo": {
      "command": "npx",
      "args": ["-y", "scanrepo-mcp"]
    }
  }
}

How It Works ░▒▓

01Agent calls scan_repoYour AI agent hands the server a repo URL — before cloning a single file.

02Static analysis engineScanRepo downloads a tarball snapshot and runs 60+ detection rules, entropy analysis and an import graph over every file.

03Score, verdict, reportThe agent gets back a 0–100 risk score, a verdict and a link to the full human-readable report.

04Cached & read-onlyResults are cached so repeat checks are instant. Static analysis only — nothing is ever cloned to your machine or executed.

Verdicts are heuristics — a LOW RISK score means nothing was found, not that a repo is guaranteed safe. Set SCANREPO_API_URL to point the server at another ScanRepo instance. Learn more about the protocol at modelcontextprotocol.io.