CyberLens
NPM · @SHADOPRIZM/CYBERLENS-MCP-SERVER · SCANNED AUG 5
Security scanning for websites, public repositories, and Open CLAW skills.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →
Supply Chain Security87
- No malware found by supply-chain analysis.Pass
- Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.Partial
- No install/post-install scripts declared.Pass
- Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree. View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 128 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability66
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 1375 tokens (~137/item across 10 items; 10 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management30
- Stability observed for 9 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.
npm · @shadoprizm/cyberlens-mcp-server
claude mcp add shadoprizm-cyberlens-mcp-server -- npx -y @shadoprizm/cyberlens-mcp-server
codex mcp add shadoprizm-cyberlens-mcp-server -- npx -y @shadoprizm/cyberlens-mcp-server
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"shadoprizm-cyberlens-mcp-server": {
"type": "local",
"command": [
"npx",
"-y",
"@shadoprizm/cyberlens-mcp-server"
],
"enabled": true
}
}
} openclaw mcp add shadoprizm-cyberlens-mcp-server --command npx --arg -y --arg @shadoprizm/cyberlens-mcp-server
mcp_servers:
shadoprizm-cyberlens-mcp-server:
command: "npx"
args: ["-y", "@shadoprizm/cyberlens-mcp-server"] {
"mcpServers": {
"shadoprizm-cyberlens-mcp-server": {
"command": "npx",
"args": [
"-y",
"@shadoprizm/cyberlens-mcp-server"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 5 Aug 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 27 to 30. That category is still filling its 30-day observation window: 8 days of observed history at the previous scan, 9 at this one. The score rises as the window fills, whether or not the server changes.
- 3 Aug 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 20 to 23. That category is still filling its 30-day observation window: 6 days of observed history at the previous scan, 7 at this one. The score rises as the window fills, whether or not the server changes.
- 2 Aug 26 +46
- Provenance: unverified → fail ▼ security
- Malware scan: unverified → pass ▲ security
- Install scripts: unverified → pass ▲ security
- Known CVEs: unverified → partial ▲ security
- Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window). security
- Stability: unverified → 0.20 ▲ functional
- Schema quality: unverified → good ▲ functional
- License: unverified → pass ▲ functional
- Dependency health: unverified → partial ▲ functional
- Maintenance: unverified → pass ▲ functional
- MCP protocol: unverified → pass ▲ functional
- Licence: MIT functional
- 1 Aug 26 +15
- Tool coverage: unverified → 100 ▲ functional
- 31 Jul 26 −22
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 30 Jul 26 +3
- Malware scan: pass → unverified ▼ security
- Tool coverage: unverified → 100 ▲ functional
- First check of Tool coverage: 100 functional
- First check of Schema quality: fail functional
- First check of Schema quality: unverified functional
- First check of Schema quality: fail functional
- 28 Jul 26 −2
- Dependency health: partial → unverified ▼ functional
- 27 Jul 26 26
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Aug 2026 · Analysed npm/@shadoprizm/[email protected]
Provenance none
Ecosystem: npm · Outcome: none
Dependencies 95 packages
95 packages in the resolved dependency tree · 95 deprecated · 29 stale.
The dependency tree was only partially resolved, so these counts may be incomplete.
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.
connect_account ~109
Connect your CyberLens account to this MCP server. Opens your browser to cyberlensai.com where you can sign up for free or log in. After authorizing, your API key is securely saved locally. Free accounts get 5 scans/month. No credit card required. If you already have an API key, you can also set the CYBERLENS_API_KEY environment variable instead. Cloud tools can also launch this flow automatically the first time repository or account-only tools need an account.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_account_quota ~89
Get your CyberLens account quota and remaining cloud scans. Returns: - Current plan name - Total scans used, limit, and remaining - Website scan usage - Repository or skill scan usage Use this to confirm your account is connected and check how many cloud scans remain. If no account is connected yet, the MCP server will launch the CyberLens browser flow automatically before checking quota.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_remediation_guide ~134
Get detailed remediation guidance for a specific vulnerability or CWE. Returns: - Explanation of the vulnerability - Step-by-step fix instructions - Code examples (before/after) - Testing procedures - Prevention strategies Uses a built-in local guide library, so it still works even when no cloud guidance endpoint is available.
| Name | Type | Req | Description |
|---|---|---|---|
| context | string | — | Additional context about your stack (e.g., 'react', 'express', 'django', 'claw-skill') |
| cwe_id | string | yes | CWE ID (e.g., 'CWE-79', 'CWE-89') or vulnerability name |
No output schema declared.
No examples provided.
get_scan_results ~142
Retrieve detailed findings from a completed security scan. Returns: - Overall security score (0-100) - List of vulnerabilities with severity levels - CWE classifications - Specific recommendations for each finding - CVE references where applicable - Remediation guidance links Use this after initiating a full cloud scan with scan_website or scan_repository. Local quick website scans return findings immediately and do not produce a scan ID. If no account is connected yet, the MCP server will connect first and then retrieve the cloud scan result.
| Name | Type | Req | Description |
|---|---|---|---|
| scan_id | string | yes | The scan ID returned from scan initiation |
| severity_filter | string | — | Filter results by severity level |
No output schema declared.
No examples provided.
get_scan_transparency ~88
Get an honest transparency report for this MCP server. Returns: - Current MCP server version - Local check inventory and category counts - Which live cloud API endpoints this server actually uses - Recent changes to the MCP scan surface Use this to understand exactly what this server checks locally and which cloud features are live.
| Name | Type | Req | Description |
|---|---|---|---|
| include_changelog | boolean | — | Include recent changes to the scanner |
No output schema declared.
No examples provided.
get_security_score ~101
Get a quick security rating for a website. Returns: - Overall security score (0-100) - Grade (A-F) - Key metrics summary - Quick wins for improvement Without an account, this uses the local quick website scanner. With an account, this uses the full CyberLens cloud path. If cloud website quota is exhausted, CyberLens falls back to the local quick score automatically.
| Name | Type | Req | Description |
|---|---|---|---|
| url | string | yes | The website URL to check |
No output schema declared.
No examples provided.
scan_claw_skill ~214
Scan an Open CLAW skill or plugin from CLAUDE Hub before installation. Runs locally in the MCP server and understands CLAW skill packaging, manifest permissions, and AI agent security models. Performs comprehensive security analysis on: - CLAUDE Hub skill/plugin download links - Skill manifest files - Embedded code and dependencies Checks for: - Hardcoded secrets and API keys in skill code - Vulnerable npm/pip dependencies - Insecure file operations - Suspicious network requests - Unsafe eval() or code injection patterns - Privilege escalation risks - Data exfiltration patterns - Permission scope appropriateness Use this BEFORE installing any CLAW skill to ensure it's safe for your environment. Examples: - CLAUDE Hub URL: https://clawhub.ai/username/skill-name - Plugin download: https://*.convex.site/api/v1/download?slug=skill-name
| Name | Type | Req | Description |
|---|---|---|---|
| skill_url | string | yes | CLAUDE Hub skill URL or direct skill download link |
No output schema declared.
No examples provided.
scan_repository ~198
Scan a public repository for secrets, dependency risks, and suspicious code patterns. Uses the live CyberLens cloud repository scanner for: - Public GitHub, GitLab, and Bitbucket repositories - Supported CLAUDE Hub or direct ZIP download URLs Checks for: - Exposed secrets and credentials - Vulnerable dependencies - Suspicious or risky code behavior - Trust posture and repository hygiene signals - Artifact and package reputation issues Returns a scan ID that can be used with get_scan_results to retrieve findings. If no account is connected yet, the MCP server will open the CyberLens browser flow automatically and then continue the scan.
| Name | Type | Req | Description |
|---|---|---|---|
| branch | string | — | Optional branch name to scan. Defaults to the repository's default branch. |
| depth | string | — | Surface is faster. Deep runs a broader repository analysis. |
| repository_url | string | yes | The repository URL to scan (for example https://github.com/owner/repo) |
No output schema declared.
No examples provided.
scan_website ~187
Scan a website for security vulnerabilities with a local quick mode and a full cloud mode. Without a connected account, the MCP server runs a local quick scan immediately. That local mode covers roughly 15 core checks such as HTTPS, security headers, basic form issues, inline scripts, and server disclosure. With a connected account, CyberLens starts the full cloud scan with 70+ checks. That path returns a scan ID you can use with get_scan_results. If cloud website quota is exhausted, CyberLens falls back to the local quick scan automatically and opens the upgrade page.
| Name | Type | Req | Description |
|---|---|---|---|
| database_connection | object | — | Optional database connection for database security scanning |
| scan_type | string | — | Cloud scan profile. Local mode always uses a quick scan and warns if full or database was requested. |
| url | string | yes | The website URL to scan (e.g., https://example.com) |
No output schema declared.
No examples provided.
validate_claw_skill ~113
Validate a CLAW skill manifest and configuration for security best practices. Checks: - Skill manifest.json structure and required fields - Permission scopes (are they minimal?) - External API dependencies - File system access patterns - Environment variable usage - Plugin isolation safety Use this before publishing a skill to CLAUDE Hub or for CI/CD validation.
| Name | Type | Req | Description |
|---|---|---|---|
| manifest_json | string | yes | The skill's manifest.json content as a string |
| skill_code | string | — | Optional: main skill code for deeper analysis |
No output schema declared.
No examples provided.