Security Scan

Active vulnerability scan for any MCP proxy you've created. The scanner pushes payloads through the gateway with an internal trust path, captures every response, and emits findings tagged by severity, OWASP category, CWE, and a copy-pasteable rule the operator can apply.

What the scan does#

When you launch a scan against an MCP proxy, the platform runs a curated set of probes against every tool the proxy exposes. Each probe targets a specific weakness class — SQL injection, command injection, SSRF, broken authorisation, tool poisoning, blind RCE via DNS callback, and so on. The scanner sends payloads, watches the response for known fingerprints, and rolls up confirmed hits into findings.

The scan is always run throughthe AIronClaw gateway — the same path real callers take in production. That means rules, DLP, rate limits and prompt guards you already have configured are also applied to probe traffic. A "clean" scan tells you the firewall is doing its job for the patterns the scanner can simulate.

How to trigger a scan#

From the dashboard, open Security Scan in the sidebar. Pick the MCP proxy you want to test and click Run new scan. The run is queued immediately and progress streams into the dashboard in real time — you can watch probes start, requests fly, and findings land as they're confirmed.

Each user has a hard cap of one concurrent run at a time. Daily budget defaults to 50 scans / 24h and 500 upstream requests per scan. Both caps are configurable per account.

What you control at run time

Target profile#

For each MCP you can pre-declare a target profile so the scanner narrows its payload packs and toggles heavy probes appropriately. The profile lives on the MCP, not on the individual run — you set it once.

Profile fields

Probe families#

The scanner ships with ~40 probes organised in families. Families that mostly run silently (protocol, transport, auth) are always on; heavier ones (CVE replays, behavioural, OOB) are conditionally on based on target profile and account caps.

Coverage matrix

Findings & severity#

Each confirmed finding carries: severity, title, affected tool and field, OWASP / CWE / CVE references, description, evidence (response excerpt + signal breakdown), a copy-pasteable proof-of-concept (curl + JSON-RPC envelope), and a remediation paragraph. When the finding maps to a known mitigation rule, you also get a Suggested rule block ready to paste into MCP rules.

Severity scale

Printable report#

Every completed scan can be exported as an A4 print-ready report. Click Generate report on a completed run. You'll get a multi-page document covering:

• Cover page with a severity sunburst summarising the distribution of findings.
• Executive summary with a posture pill (clean / attention / at-risk), four KPI cards (total findings, probes run, requests sent, scan duration), severity breakdown tiles, top three findings, and an auto-generated narrative paragraph.
• Findings index table sorted by severity.
• One section per finding with description, evidence, proof of concept, remediation paragraph, and references list.
• Methodology appendix with scan parameters, per-probe request/finding counts, severity definitions, and report metadata.

Print via ⌘P / Ctrl+P — the page is laid out for A4 with print-color-adjust enabled so the dark cover and severity tiles preserve their styling in the PDF.

Out-of-band detection#

Some classes of vulnerability can't be detected from the response alone — the tool may exec a command and silently discard the output, or fetch an attacker URL and never echo it back. The OOB layer covers these cases by giving every probe a unique callback hostname. When the upstream (or a chain reachable from it) issues a DNS lookup or HTTP request to that hostname, the platform binds the callback back to the probe that armed it and emits a critical finding.

OOB detection runs automatically when the scanner is paired with an out-of-band sink (configured by the operator). When it isn't available, the OOB-bound probes skip themselves gracefully — the rest of the scan still runs.

OOB-bound probes

REST API#

The full scan flow is also reachable over REST. Authentication uses the same personal access token described under Authentication.

Endpoints