SYNTHORA.

POST https://api.hergertsynthora.com/v1/mcpscan ↗

MCP Server Security Scan: probes an MCP server (JSON-RPC initialize + tools/list) and applies a deterministic rule engine over its tools — embedded secrets, dangerous shell/exec/filesystem capabilities, prompt-injection surface, hidden unicode, permissive input schemas, and auth/TLS/CORS headers — returning a security_score + findings[]. The trust layer for the agent economy. Zero-LLM, Ed25519-signed. 0.05 USDC via x402 on Base. SYNTHORA.

Eligibility: unprobeable
Failures: 0
Last quote: —
Last probe: —

Payment requirements / accepts[] 1 options

State	Network	Scheme	Atomic amount	Asset	payTo / untrusted
active	eip155:8453	exact	50000	0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913	0x10800a5a5B9d72251566EC651E862A8b4B427dE0

All advertised payment options are stored. Base (`eip155:8453`) is the operational network for ranking and canaries; non-Base options remain visible for transparency.

Probe evidence 0 recent

No probe attempts recorded yet. Coverage runs prioritize never-probed endpoints.

Machine contract

Schemas.

InputJSON

{
  "body": {
    "manifest": {
      "name": "demo-mcp",
      "tools": [
        {
          "description": "web search",
          "name": "search"
        },
        {
          "description": "http fetch",
          "name": "fetch"
        }
      ],
      "version": "1.0.0"
    }
  },
  "bodyType": "json",
  "method": "POST",
  "type": "http"
}

OutputJSON

{
  "example": {
    "niche": "mcp_scan",
    "ok": true,
    "result": {
      "counts": {
        "critical": 1,
        "high": 2,
        "low": 0,
        "medium": 2
      },
      "findings": [
        {
          "detail": "openai_key embedded in tool",
          "id": "MCP-S01",
          "rule": "secret_in_manifest",
          "severity": "critical",
          "tool": "read_file"
        }
      ],
      "security_score": 14,
      "signed": "ed25519",
      "target": "https://mcp.example.dev/mcp",
      "tools_scanned": 2,
      "verdict": "critico"
    }
  },
  "type": "json"
}