public-scan

Scan Mcp Endpoint

Grade a LIVE MCP server by its endpoint URL — enumerates the served tools/list and scores the capability surface (tool-poisoning, schema risk, dangerous-capability taxonomy + lethal trifecta, annotation truthfulness). coverage.surface = mcp, live-observed (point-in-time). Streamable-HTTP only. E.g. /public/scan/mcp?endpoint=https://mcp.example.com/mcp. &probe=true additionally runs the opt-in live probe (see probe).

get/api/v1/public/scan/mcp

Request

  • Base URL: https://agentavow.com (the document declares no server; this is the origin it was published from)
  • URL: https://agentavow.com/api/v1/public/scan/mcp
  • Auth: none declared

Query parameters

endpointstring required

The MCP server's Streamable-HTTP URL

forceboolean

Bypass cache and force a fresh scan

probeboolean

Opt-in live probe: call the server's read-only-annotated tools once each with synthetic inputs (at most 10, 8 s each). Advisory only — reported in behavioral with plan: live-probe, never part of the signed score. Use on servers you own or are allowed to test.

Response

Successful Response

staleboolean
repostring required
trust_scoreinteger required
security_scoreinteger
trust_tierstring required
scan_resultstring required
verdictstring
verdict_reasonstring
decisionstring
decision_finalboolean
decision_reasonstring
capabilitiesobject[]
positive_signalsstring[]
gradestring

Deprecated legacy field; read decision, trust_score and certified.

certifiedobject
certified_markboolean
certified_mark_reasonstring
coverageobject
supply_chainobject
coverage_gapsobject
not_checkedstring[]
incident_historyobject
deprecationstring nullable
package_versionstring nullable
published_atstring nullable
behavioral_score_effectobject
provenanceobject
surface_detailobject
declared_scopeobject
env_readsstring[]
package_coordinateobject
tool_descriptionstring
long_descriptionstring
category_scoresobject
scanned_atstring required
cachedboolean
tool_manifest_digeststring nullable
tool_digestsobject
tool_listobject[]
skill_collectionobject nullable
tool_driftobject nullable
jwsstring required
algorithmstring
key_idstring
jwks_urlstring
entity_trustobject nullable
trust_envelopeobject nullable
behavioralobject nullable
score_notestring
gateway_infoobject

Changes

No recorded changes to this operation across all 1 revision of this API.