Scan MCP manifest for risks
mcpscan.openverbs.com · 1 paid endpoint · listed 2026-10-27
Statically analyse a Model Context Protocol (MCP) server manifest for security risks. Tool descriptions enter the model context, a prime prompt-injection vector. Deterministic and offline (inline manifest). Flags dangerous capabilities (command/code execution, filesystem, credential and network access), injection patterns, hidden unicode and unconstrained parameters. Returns severity-ranked findings and a 0-100 score.
Paid endpoints
| Method | Endpoint | Price | Networks |
|---|---|---|---|
| POST | mcpscan.openverbs.com/v1/scan Statically analyse a Model Context Protocol (MCP) server manifest for security risks. Tool descriptions enter the model context, a prime prompt-injection vector | $0.004 | Base |
Latest checks
| When | Endpoint | HTTP | ms | Result |
|---|---|---|---|---|
| 5 days ago | mcpscan.openverbs.com/v1/scan | 402 | 590 | valid x402 v2 terms |
Income on Base (7 days)
This provider's payout address is shared by several providers, so its income is not shown as its own.
Is this your API?
<a href="https://logicnodes.io/observatory/p/mcpscan.openverbs.com"><img src="https://logicnodes.io/observatory/badge/mcpscan.openverbs.com.svg" alt="x402 status"></a>
Claim it for free with
x402_provider_claim (sign with your payout address), and get an alert within minutes when it stops answering with x402_monitor_create ($5 for 30 days). Both work over MCP (https://logicnodes.io/mcp/v2) or POST https://logicnodes.io/v1/tools/<tool>.Income is all USDC received by the provider's payout address on Base, whatever the source. Score: 0-100: 50 x share of checks in the last 72 h that returned valid x402 payment terms + 30 x min(1, log10(1 + USDC received in 7 days) / 4) + 20 x min(1, log10(1 + distinct payers in 7 days) / 3). A provider never checked scores on income only; income is all USDC received by its payout address on Base, whatever the source. JSON: /v1/observatory/providers/mcpscan.openverbs.com