ScopeBlind MCP Plugin

Scan APIs, provision signed receipt protection, and manage MCP server security — from inside AI coding tools.

Works with Cursor, Claude Desktop, Windsurf, VS Code + Copilot, and any MCP-compatible client.

Looking for MCP server security? If you want to wrap an MCP server with per-tool policies, rate limiting, and structured decision logs, see protect-mcp — a separate, standalone gateway. This plugin (scopeblind-mcp) is for scanning web APIs and managing ScopeBlind tenants from within your editor.

Install

Cursor

Add to ~/.cursor/mcp.json:

{
  "mcpServers": {
    "scopeblind": {
      "command": "npx",
      "args": ["-y", "scopeblind-mcp"]
    }
  }
}

Claude Desktop

Add to claude_desktop_config.json:

{
  "mcpServers": {
    "scopeblind": {
      "command": "npx",
      "args": ["-y", "scopeblind-mcp"]
    }
  }
}

Any MCP Client

npx scopeblind-mcp

The server uses stdio transport (JSON-RPC over stdin/stdout).

Tools

| Tool | What It Does | |------|-------------| | scan_endpoint | Scan any API URL for abuse vulnerabilities (missing rate limiting, replay protection, CORS exposure) | | provision_tenant | Create a ScopeBlind tenant — get a slug, verifier URL, and deploy config. Starts in observe mode. | | get_abuse_report | Fetch real-time stats: total requests, unique devices, abuse rate, dollar waste estimate | | get_integration_code | Generate framework-specific code: script-tag, express, fastapi, nextjs, agent-sdk, gateway |

Example Conversations

"Scan my signup API for vulnerabilities" → AI calls scan_endpoint → shows risk level, specific issues, and a fix recommendation

"Protect my Express API from bot abuse" → AI calls provision_tenant → then get_integration_code with framework: "express" → gives you copy-paste middleware

"How much am I losing to bot traffic?" → AI calls get_abuse_report with your slug + cost_per_request → shows abuse rate and dollar estimate

How It Works

You (in Cursor/Claude) → Ask about API protection
        ↓
AI discovers ScopeBlind MCP plugin
        ↓
Plugin scans your endpoint → shows vulnerabilities
        ↓
Plugin provisions a tenant → generates integration code
        ↓
You deploy → observe mode collects data
        ↓
Plugin shows abuse report → you enforce when ready

Related

• protect-mcp — MCP server security gateway. Wraps any stdio MCP server with per-tool policies (allow, block, rate_limit), structured decision logs, and observe/enforce modes. Free, zero dependencies, no account required.
• scopeblind — Node.js middleware for web API protection with signed receipts.
• scopeblind-agent — DPoP-based cryptographic identity for AI agents and CLIs.

Links

• Website: https://scopeblind.com
• Docs: https://scopeblind.com/docs
• protect-mcp: https://npmjs.com/package/protect-mcp
• npm: https://npmjs.com/package/scopeblind-mcp
• GitHub: https://github.com/scopeblind/scopeblind-gateway

License

MIT