A security scan whose result exists only in the response is a snapshot nobody can cite. Storing them with ids means a finding can be referenced in a ticket, re-read after a fix, and compared against the next run — which is how scanning becomes a practice rather than an event. The surface is deliberately small. The important operational point is the obvious one: this actively probes an endpoint, so it belongs pointed at your own APIs or ones you have written permission to test.
A three-tool API security scanning client: run a scan against an endpoint, retrieve a past scan's results, and list what has been scanned before.
- scan_api scans an endpoint and returns findings with a risk score attached.
- get_scan retrieves a previous scan by its id, so results are addressable after the fact rather than only in the moment.
- list_scans returns the scan history, which is what makes a comparison over time possible.
MIDDLEBRICK_API_KEY. Scanning an endpoint is an active test — run it against APIs you are authorised to test.
One command plus a key — npx -y @middlebrick/mcp-server, then supply credentials