How We Scan
Agents and MCP servers run with access to your files, keys and accounts. Here's what our automated scan runs. Results are governed by our scan policy.
Each scan runs on a brand-new virtual machine with no access to AgenticMart's systems or keys. It is destroyed when the scan ends.
We scan one exact commit. The report always says which, so you know what was checked.
Semgrep rules look for eval, shell execution, reading environment variables, writing outside the project, and obfuscated code.
Gitleaks checks the repository for leaked API keys and tokens.
OSV-Scanner checks every dependency against known vulnerability databases.
We read the declared permissions — which domains it talks to and which environment variables it needs.
We try to install and start it. MCP servers that boot complete a protocol handshake and list their tools.
When a project boots, outbound connections during the run are recorded. Connections to domains it didn't declare are flagged.
See what the scan finds across the whole catalogue in our MCP server security statistics, or browse security-scanned MCP servers.
Badges
Questions
What does the scan look for?
Hidden or encoded code that runs itself, crypto miners, reverse shells, known-malicious packages, install scripts that download and run code, and code that reads secrets and sends them somewhere. It also lists what the tool can do and known-vulnerable dependencies, so you know what you're giving it access to. For the full terms, see our scan policy.
What does Scanned mean?
The listing went through the checks shown in its report, at the commit named there, under our scan policy. Always check what access you're granting.
How much does a scan cost?
Nothing. Scans are free.
My listing is held or was removed. What now?
We don't list repos our scan can't clear. Claim the listing or contact us and we'll look at it again. Fixing the cause and rescanning brings it back.
When are listings re-scanned?
A maintainer can claim the listing and start a new scan at any time. The report always names the commit and date it covers.
Scan results are provided under our scan policy.