shadoprizm/cyberlens-mcp-server

> **Security scanning for AI assistants and agentic coding workflows.**
A Model Context Protocol (MCP) server that gives AI assistants the ability to scan websites, public repositories, and Open CLAW skills for security vulnerabilities. It's purpose-built for the agentic coding era, with native support for scanning skill packages before you install them.
---
What It Does
When connected to an AI assistant (Claude Desktop, VS Code, etc.), this MCP server adds security scanning tools that the assistant can use during your conversation:
- **Scan a CLAW skill** before installing it -- the server downloads the skill package, extracts it, and analyses the actual source code for dangerous patterns, hardcoded secrets, and permission issues
- **Scan a website** in a local quick mode without an account, or use the full cloud scan when connected
- **Scan a public repository** for exposed secrets, dependency vulnerabilities, suspicious code patterns, and trust posture issues
- **Check your remaining cloud scan quota** before kicking off a batch of scans
- **Get remediation guidance** with step-by-step fix instructions and code examples
Example Conversation
---
Getting Started
1. Install
After the first npm release, the recommended install path is:
Before that, or for local development and manual builds:
2. Add to Your AI Assistant
**Claude Desktop** -- add to ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):
If you are running from a source checkout instead of npm:
**Claude Code** -- add to your MCP settings or project configuration.
**VS Code (Copilot/Continue)** -- configure per your extension's MCP server settings.
3. Connect Your Account
Website tools work immediately without an account in local quick mode. That local mode covers roughly 15 core checks and returns results right away.
Connecting an account upgrades website scans to the full CyberLens cloud path with 70+ checks, scan history, and AI analysis. Repository and account-only tools still connect through the browser flow when needed.
When a repository or account-only tool needs an account, the MCP server:
1. opens the CyberLens browser flow automatically
2. sends the user to cyberlensai.com to sign up or log in
3. receives the secure callback locally
4. saves the API key to ~/.cyberlens/mcp/config.json
5. continues the original tool call automatically
You can also trigger the same flow explicitly:
This opens your browser to cyberlensai.com where you can sign up (free) or log in. Your API key is saved locally at ~/.cyberlens/mcp/config.json and used for all future scans.
**Free accounts** include 5 scans/month. No credit card required.
> You can also set the CYBERLENS_API_KEY environment variable in the MCP config instead of using the browser flow.
If a cloud website scan hits its monthly quota, the MCP server opens the CyberLens pricing page automatically and falls back to the local quick scan instead of hard-failing. Repository scans still require cloud quota.
---
Available Tools
Account
| Tool | Description | Requires API Key |
|------|-------------|:---:|
| connect_account | Opens browser to sign up/log in and saves your API key locally | No |
| get_account_quota | Shows your current plan and remaining website/repository scan quota; auto-connects on first use if needed | Yes |
CLAW Skill Scanning
| Tool | Description | Requires API Key |
|------|-------------|:---:|
| scan_claw_skill | Download and analyse a CLAW Hub or direct skill package for security issues | No |