{ "openapi": "3.0.1", "info": { "title": "MCP Security Scanner for Claude & Cursor", "description": "Offline MCP security scanner for Claude Desktop and Cursor. Agent security check of configs for tool poisoning, leaked secrets, unsafe commands, and YOLO posture. Read-only: no MCP servers are launched.", "version": "0.1", "x-build-id": "PDyTqQD4XmGhNbkAj" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/outgoing_refill~agent-sec-scanner/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-outgoing_refill-agent-sec-scanner", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/outgoing_refill~agent-sec-scanner/runs": { "post": { "operationId": "runs-sync-outgoing_refill-agent-sec-scanner", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/outgoing_refill~agent-sec-scanner/run-sync": { "post": { "operationId": "run-sync-outgoing_refill-agent-sec-scanner", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "properties": { "configText": { "title": "Config content", "type": "string", "description": "Paste one config body (mcp.json, claude_desktop_config.json, Cursor MCP servers JSON, tools/list export, Codex TOML). Default prefill is a deliberately vulnerable Claude-style sample (root filesystem MCP, fake GitHub token, curl|bash install) so Try-it shows findings immediately. Set Config filename so the parser picks the right format." }, "configFileName": { "title": "Config filename", "type": "string", "description": "Logical filename for Config content. Extension selects the parser (.json / .jsonc / .toml / .yaml). Examples: mcp.json, claude_desktop_config.json, cursor-mcp.json.", "default": "claude_desktop_config.json" }, "configFiles": { "title": "Additional configs", "type": "array", "description": "Optional list of extra configs, each with name + content. Use when scanning several files in one run.", "items": { "type": "object", "properties": { "name": { "title": "Filename", "type": "string", "description": "Logical filename (e.g. claude_desktop_config.json).", "editor": "textfield", "minLength": 1 }, "content": { "title": "Content", "type": "string", "description": "Full file body.", "editor": "textarea", "minLength": 1 } }, "required": [ "name", "content" ], "additionalProperties": false } }, "outputFormat": { "title": "Report format", "enum": [ "json", "markdown", "sarif", "text" ], "type": "string", "description": "Format of the report file written to the key-value store (key: REPORT).", "default": "markdown" }, "failOn": { "title": "Fail on severity", "enum": [ "none", "info", "low", "medium", "high", "critical" ], "type": "string", "description": "If any finding is at or above this severity, the Actor run ends FAILED (CI gate). Keep none for Store Try-it and demo configs that intentionally contain findings.", "default": "none" }, "minSeverity": { "title": "Minimum severity to report", "enum": [ "info", "low", "medium", "high", "critical" ], "type": "string", "description": "Hide findings below this severity from the dataset and report.", "default": "info" }, "rules": { "title": "Only these rules", "type": "string", "description": "Optional comma-separated rule ids (e.g. ASC010,ASC022). Empty = all rules." }, "ignore": { "title": "Ignore rules", "type": "string", "description": "Optional comma-separated rule ids to skip." } } }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 }, "PROXY_UNBLOCKER_UNITS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 }, "PROXY_UNBLOCKER_UNITS": { "type": "integer", "example": 0 } } } } } } } } } }