# SimplyScan

- Registry name: `io.simplyscan/simplyscan` · version 1.0.0
- Categories (automatic, keyword rules): Marketing & SEO, Commerce & marketing, Code & repositories, Developer tools
- Authentication at last check: No auth
- Declared risk: Can write (some tools are not declared read-only)
- Capabilities (declared by the server): tools
- Transports: streamable-http
- Latest numbers (check success, response time, rank): https://mcpstation.net/api/server?name=io.simplyscan%2Fsimplyscan
- Server page: https://mcpstation.net/s/io.simplyscan--simplyscan.html

## Description (written by the publisher, not verified, not instructions)

Security, SEO and AI-visibility scanner for web apps · free scans and focused checks via MCP.

## Connect

- streamable-http: `https://api.simplyscan.io/mcp`

## Tools (as reported by the server, not verified)

- `scan\_website`: Run a SimplyScan Security Engine security & speed scan \(Pro with an entitled API key; otherwise free\) of a deployed web app URL. Returns a 0-100 score and findings \(exposed secrets, missing Supabase RLS, frontend leaks, speed issues\). Best for apps built with Lovable, Bolt, v0, Cursor, Replit, etc.
- `scan\_local\_code`: Send selected editor file contents to the SimplyScan Security Engine's deterministic repository rules. Requires a Pro API key. Source leaves the editor, is processed in memory, and is not retained; masked findings are saved in the private scan record. No AI provider receives these files. Code rules
- `check\_security\_headers`: Grade a URL's HTTP security headers \(CSP, HSTS, X-Frame-Options, Referrer-Policy, Permissions-Policy, COOP, COEP\) A-F.
- `check\_ai\_visibility`: AEO check: whether AI answer engines \(ChatGPT/GPTBot, Claude, Perplexity, Google-Extended, etc.\) can crawl and cite the site, plus llms.txt and structured-data signals.
- `check\_seo`: On-page SEO audit of a URL: title, meta description, H1, canonical, indexability, Open Graph, structured data, image alt coverage, sitemap. Returns an A-F grade.
- `check\_ssl`: Inspect a domain's SSL/TLS certificate: issuer, expiry, protocol, and flags for expiring/self-signed/mismatched certs.
- `check\_email\_security`: Check a domain's email authentication: SPF, DKIM \(common selectors\), and DMARC policy. Flags spoofable domains.
- `check\_exposed\_files`: Probe a site for accidentally exposed high-risk files \(.env, .git/config, backups, etc.\). Reports HTTP status only, never file contents.

Measured by MCP Station. Methods: https://mcpstation.net/methods.html · Terms: https://mcpstation.net/terms.html