# CyberLens [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/shadoprizm/cyberlens-mcp-server  
**GitHub Stars:** 1  
**npm Downloads (last month):** 138  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/cyberlens

## Description
Security scanning for websites, public repositories, and Open CLAW skills.

## Tools
Capabilities this server exposes over MCP:

- **connect_account** — Connect your CyberLens account to this MCP server.

Opens your browser to cyberlensai.com where you can sign up for free or log in.
After authorizing, your API key is securely saved locally.

Free accounts get 5 scans/month. No credit card required.

If you already have an API key, you can also set the CYBERLENS_API_KEY
environment variable instead. Cloud tools can also launch this flow
automatically the first time repository or account-only tools need an account.
- **get_account_quota** — Get your CyberLens account quota and remaining cloud scans.

Returns:
- Current plan name
- Total scans used, limit, and remaining
- Website scan usage
- Repository or skill scan usage

Use this to confirm your account is connected and check how many cloud scans remain.
If no account is connected yet, the MCP server will launch the CyberLens
browser flow automatically before checking quota.
- **scan_claw_skill** — Scan an Open CLAW skill or plugin from CLAUDE Hub before installation.

Runs locally in the MCP server and understands CLAW skill packaging,
manifest permissions, and AI agent security models.

Performs comprehensive security analysis on:
- CLAUDE Hub skill/plugin download links
- Skill manifest files
- Embedded code and dependencies

Checks for:
- Hardcoded secrets and API keys in skill code
- Vulnerable npm/pip dependencies
- Insecure file operations
- Suspicious network requests
- Unsafe eval() or code injection patterns
- Privilege escalation risks
- Data exfiltration patterns
- Permission scope appropriateness

Use this BEFORE installing any CLAW skill to ensure it's safe for your environment.

Examples:
- CLAUDE Hub URL: https://clawhub.ai/username/skill-name
- Plugin download: https://*.convex.site/api/v1/download?slug=skill-name
- **scan_website** — Scan a website for security vulnerabilities with a local quick mode and a full cloud mode.

Without a connected account, the MCP server runs a local quick scan immediately.
That local mode covers roughly 15 core checks such as HTTPS, security headers,
basic form issues, inline scripts, and server disclosure.

With a connected account, CyberLens starts the full cloud scan with 70+ checks.
That path returns a scan ID you can use with get_scan_results.

If cloud website quota is exhausted, CyberLens falls back to the local quick scan
automatically and opens the upgrade page.
- **scan_repository** — Scan a public repository for secrets, dependency risks, and suspicious code patterns.

Uses the live CyberLens cloud repository scanner for:
- Public GitHub, GitLab, and Bitbucket repositories
- Supported CLAUDE Hub or direct ZIP download URLs

Checks for:
- Exposed secrets and credentials
- Vulnerable dependencies
- Suspicious or risky code behavior
- Trust posture and repository hygiene signals
- Artifact and package reputation issues

Returns a scan ID that can be used with get_scan_results to retrieve findings.
If no account is connected yet, the MCP server will open the CyberLens
browser flow automatically and then continue the scan.
- **get_scan_results** — Retrieve detailed findings from a completed security scan.

Returns:
- Overall security score (0-100)
- List of vulnerabilities with severity levels
- CWE classifications
- Specific recommendations for each finding
- CVE references where applicable
- Remediation guidance links

Use this after initiating a full cloud scan with scan_website or scan_repository.
Local quick website scans return findings immediately and do not produce a scan ID.
If no account is connected yet, the MCP server will connect first and then
retrieve the cloud scan result.
- **get_security_score** — Get a quick security rating for a website.

Returns:
- Overall security score (0-100)
- Grade (A-F)
- Key metrics summary
- Quick wins for improvement

Without an account, this uses the local quick website scanner.
With an account, this uses the full CyberLens cloud path.
If cloud website quota is exhausted, CyberLens falls back to the local quick score automatically.
- **get_remediation_guide** — Get detailed remediation guidance for a specific vulnerability or CWE.

Returns:
- Explanation of the vulnerability
- Step-by-step fix instructions
- Code examples (before/after)
- Testing procedures
- Prevention strategies

Uses a built-in local guide library, so it still works even when no cloud guidance endpoint is available.
- **get_scan_transparency** — Get an honest transparency report for this MCP server.

Returns:
- Current MCP server version
- Local check inventory and category counts
- Which live cloud API endpoints this server actually uses
- Recent changes to the MCP scan surface

Use this to understand exactly what this server checks locally and which cloud features are live.
- **validate_claw_skill** — Validate a CLAW skill manifest and configuration for security best practices.

Checks:
- Skill manifest.json structure and required fields
- Permission scopes (are they minimal?)
- External API dependencies
- File system access patterns
- Environment variable usage
- Plugin isolation safety

Use this before publishing a skill to CLAUDE Hub or for CI/CD validation.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "cyberlens": {
    "command": "npx",
    "args": ["-y","@shadoprizm/cyberlens-mcp-server"],
    "env": {
      "CYBERLENS_API_KEY": ""
    }
  }
}
```

**Requires environment variables:** `CYBERLENS_API_KEY` — the values above are empty placeholders; fill in real credentials before running (see the repository for what each one is for).

## Documentation

## What CyberLens MCP server does

CyberLens MCP server exposes security analysis tools for AI assistants and agentic coding workflows. It can inspect websites, public repositories, and Open CLAW skills, then return scores, findings, and remediation guidance. The server supports local checks that do not require an account as well as cloud-backed scans available after account connection.

Skill analysis is designed for packages from CLAW Hub, direct skill download URLs, or supported skill ZIP files. The scanner examines package metadata and source files for issues such as hardcoded secrets, shell execution, unsafe deserialization, insecure requests, dangerous file operations, and unpinned dependencies. It also lists external URLs used by the package.

## How it works

Website tools have two modes. A local quick scan runs without authentication and performs roughly 15 checks, including HTTPS, security headers, server disclosure, insecure forms, and inline-script indicators. A connected account enables the cloud scan path with more than 70 checks, scan history, and AI analysis. If website cloud quota is unavailable, the server falls back to the local scan rather than failing outright.

Repository scans use the cloud service and support public GitHub, GitLab, and Bitbucket repositories, along with supported ZIP targets. Cloud results can be retrieved after a scan completes. The `get_scan_transparency` tool reports which checks run locally and which endpoints use the live cloud service.

For account-required operations, CyberLens opens a browser flow at cyberlensai.com, receives a local callback, stores the API key in `~/.cyberlens/mcp/config.json`, and retries the original request. An API key can also be supplied through the `CYBERLENS_API_KEY` environment variable. Free accounts include five scans per month, according to the project documentation.

## Setup and configuration

The project requires Node.js 18 or newer. The documented package installation uses:

```bash
npx -y @shadoprizm/cyberlens-mcp-server
```

For local development, clone the repository, run `npm install`, and build with `npm run build`. A source checkout can be started with Node against `dist/index.js`.

Claude Desktop uses an MCP configuration entry with `npx` and the package name. Claude Code uses its MCP settings or project configuration, while VS Code configures the server through the relevant Copilot or Continue MCP settings. Account connection is optional for local website scans, CLAW skill scanning, manifest validation, remediation guidance, and transparency information.

## Tools and capabilities

The CyberLens MCP server provides these tool groups:

- Account connection and quota inspection.
- CLAW package scanning and manifest validation.
- Local or cloud website scanning and security scoring.
- Public repository scanning and cloud result retrieval.
- Local remediation playbooks for common CWEs and vulnerability classes.
- Reporting on local checks and cloud endpoints.

`scan_claw_skill` downloads and cleans up a temporary package before analysis. `validate_claw_skill` checks a skill manifest against security practices. `get_remediation_guide` supplies built-in fix guidance and code examples for supported vulnerability categories.

## Limitations and notes

Local website scans do not provide the full cloud check set. Requests for a cloud-only website mode without an account are handled as local quick scans instead. Repository scanning requires an account and available cloud quota. Cloud scan history and richer website analysis also depend on account access.

Skill scanning runs locally and does not send the analyzed package to an external service. The API key is stored locally when browser authentication is used, so deployments should account for filesystem access and configuration persistence.

_Full upstream README: https://allmcps.com/mcp/cyberlens/readme_