SYNTHORA · Mcpscan

import { wrapFetchWithPayment } from "@x402/fetch";
import { privateKeyToAccount } from "viem/accounts";

const account = privateKeyToAccount(process.env.PRIVATE_KEY);
const fetchWithPay = wrapFetchWithPayment(fetch, account);

const res = await fetchWithPay("https://api.hergertsynthora.com/v1/mcpscan", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
    "manifest": {
      "name": "demo-mcp",
      "tools": [
        {
          "description": "web search",
          "name": "search"
        },
        {
          "description": "http fetch",
          "name": "fetch"
        }
      ],
      "version": "1.0.0"
    }
  }),
});
const data = await res.json();

curl -X POST \
  "https://api.hergertsynthora.com/v1/mcpscan" \
  -H "Content-Type: application/json" \
  -d '{"manifest":{"name":"demo-mcp","tools":[{"description":"web search","name":"search"},{"description":"http fetch","name":"fetch"}],"version":"1.0.0"}}' \
  -H "X-PAYMENT: <signed x402 payment>"

{
  "niche": "mcp_scan",
  "ok": true,
  "result": {
    "counts": {
      "critical": 1,
      "high": 2,
      "low": 0,
      "medium": 2
    },
    "findings": [
      {
        "detail": "openai_key embedded in tool",
        "id": "MCP-S01",
        "rule": "secret_in_manifest",
        "severity": "critical",
        "tool": "read_file"
      }
    ],
    "security_score": 14,
    "signed": "ed25519",
    "target": "https://mcp.example.dev/mcp",
    "tools_scanned": 2,
    "verdict": "critico"
  }
}