# AIclude Security Vulnerability Scanner (ASVS)

> AI Agent(MCP Server, Skill) ecosystem security scanner. Automatically detects vulnerabilities in MCP servers and Claude Code skills, tests them in isolated Docker sandboxes, and generates comprehensive security reports.

## What This Service Does

ASVS scans publicly registered MCP servers and Claude Code skills for security vulnerabilities. It collects targets from 9 registries (npm, GitHub, Smithery, Glama, MCP Registry, etc.), runs 7 scan engines (SAST, SCA, DAST, Tool Analyzer, Permission Checker, Behavior Monitor, Malware Detector), and publishes risk-scored reports.

## Who Should Use This

- AI agent developers verifying their MCP server or skill is safe
- Security researchers auditing the AI agent ecosystem
- AI assistants recommending safe MCP tools to users
- CI/CD pipelines gating deployments on security scan results

## API Base URL

https://vs.aiclude.com/api

## Key Endpoints (no auth required)

- GET /api/targets — List all scanned targets (MCP servers, skills). Supports search, filtering by type/riskLevel/source, pagination.
- GET /api/targets/{id} — Full target detail including latest scan report.
- GET /api/reports — List all security reports.
- GET /api/reports/{id} — Full report with vulnerability details.
- GET /api/stats — Dashboard: total targets, scans, vulnerability breakdown.
- GET /api/stats/safe-picks — Recommended safe targets (low risk, high confidence).
- GET /api/ranking — Risk ranking of all scanned targets.
- POST /api/scan/search — Search for a target by name. Body: { "query": "..." }
- POST /api/scan/request — Request a new scan. Body: { "name": "...", "repositoryUrl": "..." }

## MCP Server

Connect the ASVS MCP server to let AI assistants directly scan tools:

```json
{
  "mcpServers": {
    "asvs": {
      "command": "npx",
      "args": ["@asvs/mcp-server"]
    }
  }
}
```

Tool: `security_scan` — Accepts name, type, description, repository_url, npm_package. Returns a full security report in markdown.

## Risk Levels

- CRITICAL — Remote code execution, auth bypass
- HIGH — Privilege escalation, data exfiltration
- MEDIUM — XSS, unsafe eval, weak crypto
- LOW — Info disclosure, verbose errors
- INFO — Recommendations, best practices

## Detailed API Documentation

See: https://vs.aiclude.com/llms-full.txt

## Contact

- Website: https://vs.aiclude.com
- GitHub: https://github.com/aiclude