ServerScan runs a public MCP server, so AI assistants like Claude and ChatGPT can answer questions about PCI ASV scanning and our plans from our own live data. It needs no account and no API key. It never buys anything, never charges anything and never creates an account. When someone is ready to sign up, it hands them a link to our site, and they check the order and pay there themselves.
Connect it
The server address is https://www.serverscan.com/api/mcp. It uses the Streamable HTTP transport and needs no sign-in. In Claude, open Settings, then Connectors, choose to add a custom connector, and paste the address. In Claude Code, run claude mcp add --transport http serverscan https://www.serverscan.com/api/mcp. Any other assistant or editor that supports remote MCP servers works the same way: add a remote server with that address and no authentication. It is also listed in the official MCP Registry as com.serverscan/mcp.
What it can do
There are four tools. Every one of them only reads, and the first three answer the same questions our public pages answer.
| Tool | What it does | Ask your assistant something like |
|---|---|---|
get_pricing |
Current prices for ASV scanning, payment page monitoring and penetration testing, read live from our store, with what each plan includes and the refund terms. | "How much does ServerScan charge to scan one domain for a year?" |
do_i_need_an_asv_scan |
Says whether a PCI DSS self-assessment questionnaire (SAQ) needs quarterly ASV scans under PCI DSS v4.0.1, and what to scan. Pass the SAQ type, or "unsure" to see every SAQ and who it is for. | "I fill out SAQ A for my Shopify store. Do I need quarterly ASV scans?" |
check_payment_page |
Runs our free one-off check of a checkout page: TLS, security headers, the HTTP to HTTPS redirect, which scripts load and from where, and whether third-party scripts carry an integrity hash. It returns six answers and what to fix first. | "Check the payment page at https://shop.example.com/checkout." |
start_order |
Gives a link to our signup page with the plan picked and the domain filled in. For a penetration test, it gives the page to request a quote. It creates nothing and charges nothing. | "Get me a signup link for a one-year scan of example.com." |
What it does not do
It cannot see your account, your scans or your reports, and it cannot change anything. It does not create carts, orders or accounts, and it never takes payment. The free page check fetches the one page you name, one time, and it has the same limits as the free check on our site: three checks a day from one address, and six a day for any one site from everyone combined. The answer to do_i_need_an_asv_scan is general guidance. Your acquiring bank or payment processor has the final say on which SAQ you file and what it asks of you.
What we keep
For each hour, we count how many requests came in, which tool was called, which kind of assistant called it (by its user agent), whether it worked and how long it took. Those counts are kept for 400 days. We do not store your questions, your conversation or what you typed into a tool. Our web server log records the address and user agent of every request, as it does for every page on this site, and is kept for two years. The free page check keeps the page address it checked, its result and a scrambled form of the caller's address for 30 days, so it can reuse a result for 15 minutes and enforce its limits. Signup links carry a tag that tells us an order started from an AI assistant. Our full privacy policy covers the rest.
Technical details
The server speaks MCP 2026-07-28 and the earlier 2025-11-25, 2025-06-18 and 2025-03-26 versions, and answers server/discover for both. It takes one JSON-RPC message per POST and returns one JSON answer, with no sessions and no event stream, so a GET gets a 405. Requests from a browser on another site are refused. Each address is rate limited to 60 requests a minute and three at once. Page check results from other sites are returned as quoted data, not as instructions, because a checked page could contain text aimed at your assistant.