Authentication

Include your API key in every request:

X-API-Key: mcp_your_key_here
# or
Authorization: Bearer mcp_your_key_here

Without an API key, you get the free tier (3 scans/day). View pricing to get an API key.

Endpoints

POST /api/v1/scan

Scan a GitHub repository for MCP security issues.

curl -X POST https://audit.pyfio.com/api/v1/scan \
  -H "X-API-Key: YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"repo": "modelcontextprotocol/servers"}'

Request body:

Field	Type	Description
repo	string	GitHub repo: owner/repo or full URL

Response (JSON):

{
  "repo": "owner/repo",
  "overallScore": 72,
  "tldr": "This server requests shell access.",
  "categories": { "permissions": { "score": 60 }, ... },
  "findings": [ ... ],
  "_meta": { "apiVersion": "v1", "plan": "starter",
    "usage": { "month": 42, "day": 3 },
    "limits": { "scansPerMonth": 100, "scansPerDay": 20 }
  }
}

GET /api/v1/usage

Check your current usage and plan limits.

curl https://audit.pyfio.com/api/v1/usage \
  -H "X-API-Key: YOUR_KEY"

Plans

Plan	Price	Scans/Month	Scans/Day
Free	€0	3*	3
Pro	€29/mo	100	20
Team	€99/mo	2,000	200
Enterprise	€299/mo	10,000	1,000

* Free tier is per IP, no API key needed.

CI/CD Integration

GitHub Actions

# .github/workflows/mcp-audit.yml
name: MCP Security Audit
on: [push]
jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - name: Scan MCP server
        run: |
          RESULT=$(curl -s -X POST https://audit.pyfio.com/api/v1/scan \
            -H "X-API-Key: ${{ secrets.MCP_AUDIT_KEY }}" \
            -H "Content-Type: application/json" \
            -d '{"repo": "${{ github.repository }}"}')
          SCORE=$(echo "$RESULT" | jq '.overallScore')
          echo "Security score: $SCORE/100"
          if [ "$SCORE" -lt 50 ]; then
            echo "::error::MCP security score below threshold"
            exit 1
          fi

Error Codes

Status	Meaning
400	Invalid request (bad repo format)
401	Invalid API key
404	Repository not found
429	Rate limit / usage limit exceeded
500	Internal error

---

Built by Pyfio — audit.pyfio.com — hello@pyfio.com