Skip to main content

​
POST /api/security/scan

Runs a full security scan (OWASP MCP Top 10 + CVEs + poisoning detection) on all configured servers. Each scan triggers a health check first to get the live tools list. 
curl -X POST http://localhost:8000/api/security/scan

[
  {
    "server_name": "postgres-mcp",
    "scanned_at": "2026-03-17T12:00:00Z",
    "error": null,
    "findings_count": 1,
    "critical_count": 0,
    "high_count": 0,
    "highest_severity": "medium",
    "findings": [
      {
        "severity": "medium",
        "category": "OWASP-MCP-01",
        "title": "No authentication configured",
        "description": "Server has no auth credentials in its configuration.",
        "remediation": "Add an API key or token to the server's env configuration.",
        "tool_name": null,
        "cve_id": null
      }
    ]
  }
]

​
Severity levels

SeverityExamples
criticalRemote code execution CVE, prompt injection
highUnauthenticated SSE server, destructive tools without auth
mediumNo auth on stdio server, missing input schemas
lowMinor config warnings
infoInformational findings