API Documentation

Scan MCP skills and servers for security threats — programmatically via REST, or as MCP tools for AI agents. Every number on this page reflects the real, current API — not aspirational endpoints.

REST API
MCP Server

Free Endpoints $0.00

No payment required, no API key needed.
POST/api/v1/clawscan/full-scantier: free
Instant 25-pattern grammar scan on SKILL.md content. Set "tier": "free" in the body — the same endpoint also runs the paid tiers below.
curl -X POST https://verifyclaw.io/api/v1/clawscan/full-scan \
  -H "Content-Type: application/json" \
  -d '{"skill_content": "# My Skill\n## Tools\n...", "tier": "free"}'

# Response
{
  "final_risk_score": 0,
  "final_risk_level": "LOW",
  "grammar_report": { "findings": {...}, "recommendation": "..." },
  "layers_run": ["grammar_parser"]
}
GET/api/v1/mcp-registry
List every MCP server VerifyClaw has tested. ?q= filters by URL substring, ?sort=trust_score|tested_at.
curl https://verifyclaw.io/api/v1/mcp-registry?q=github&sort=trust_score

# Response
{
  "entries": [
    {
      "mcp_url": "https://github.com/github/github-mcp-server.git",
      "trust_score": 100,
      "techniques_tested": 86,
      "techniques_passed": 73,
      "techniques_failed": 0,
      "techniques_pending": 13,
      "tested_at": "2026-07-28T00:45:40Z"
    }
  ],
  "total": 1
}
GET/api/v1/mcp-registry/entry
One server's full report, inline. Query param is mcp_url (not url).
curl "https://verifyclaw.io/api/v1/mcp-registry/entry?mcp_url=https://github.com/github/github-mcp-server.git"
GET/api/v1/landing-stats
Live corpus counts — registry size, total scans, threats found, authors tracked. Always current, queried straight from MongoDB on every request.
curl https://verifyclaw.io/api/v1/landing-stats

{"registry_skills": 78848, "total_scans": 74966, "threats_found": 6363, "authors": 4178}
GET/api/v1/clawscan/patterns
List all 25 grammar-based threat patterns ClawScan checks for.

Paid Endpoints

Send an x-payment-token header. Without one, these return HTTP 402 with pricing info instead of the scan result.
POST/api/v1/clawscan/full-scan
Same endpoint as the free tier — set "tier": "standard" ($0.02, adds VirusTotal hash checks on bundled files) or "tier": "deep" ($0.10, adds Opus/Sonnet AI semantic analysis — catches hidden instructions, credential harvesting, social engineering that grammar patterns miss).
curl -X POST https://verifyclaw.io/api/v1/clawscan/full-scan \
  -H "Content-Type: application/json" \
  -H "x-payment-token: <your_x402_token>" \
  -d '{"skill_content": "...", "tier": "deep"}'
POST/api/v1/saf-scan full_86 is async
Full SAF-MCP security audit against a live MCP server.
"scan_type": "shallow_33" — 33 static-detector techniques over the target's Git repo, synchronous, returns the report immediately. $5.00.
"scan_type": "full_86" — all 86 techniques via real Morph Cloud sandboxes + Claude semantic checks, ~4 minutes. Returns a job_id immediately — poll GET /api/v1/saf-scan/status/{job_id} for the result. $49.00. 
# Fast path — static 33, synchronous
curl -X POST https://verifyclaw.io/api/v1/saf-scan \
  -H "x-payment-token: <token>" \
  -d '{"mcp_url": "https://github.com/org/mcp-server.git", "scan_type": "shallow_33"}'

# Deep path — full 86, async job
curl -X POST https://verifyclaw.io/api/v1/saf-scan \
  -H "x-payment-token: <token>" \
  -d '{"mcp_url": "https://mcp.example.com", "scan_type": "full_86"}'
# => {"status": "started", "job_id": "saf-full86-...", "poll_url": "/api/v1/saf-scan/status/saf-full86-...", "eta_seconds": 240}

curl https://verifyclaw.io/api/v1/saf-scan/status/saf-full86-...
# => {"status": "running"}  or  {"status": "completed", "report": {...}}
full_86 targets must already be a live, HTTP/SSE-reachable MCP server — the sandbox speaks MCP JSON-RPC directly to mcp_url. A bare Git repo URL won't work for this scan_type (nothing clones/builds/exposes it first); use shallow_33 for repo-only targets instead.

Pricing Summary

EndpointWhatCost
full-scan (free)25 grammar patternsFree
mcp-registryRegistry lookup / listingFree
landing-statsLive corpus countsFree
full-scan (standard)+ VirusTotal hash check$0.02
full-scan (deep)+ AI semantic analysis$0.10
saf-scan (shallow_33)33 static techniques, sync$5.00
saf-scan (full_86)86 techniques, live sandbox, async$49.00
Payment is via the x402 USDC micropayment protocol. Not yet enforced in production — every endpoint above is currently free to call regardless of tier while payment verification is finalized; pricing shown is what will apply once enabled.

MCP Server Endpoint for AI agents

Connect an AI agent directly to VerifyClaw as MCP tools — no REST client code needed.
SSE endpoint: https://verifyclaw-mcp.verifyclaw.io/sse

Claude Desktop Configuration

{
  "mcpServers": {
    "verifyclaw": {
      "url": "https://verifyclaw-mcp.verifyclaw.io/sse"
    }
  }
}

Tools Exposed

ToolDescriptionCost
scan_skill25-pattern instant security scanFree
get_trust_scoreMCP server trust score lookupFree
list_threatsBrowse known threat signaturesFree
check_authorAuthor reputation / skill countFree
check_exfil_ipExfiltration IP blocklist checkFree
healthService status + live corpus statsFree
deep_scan_skillAI semantic security analysis$0.10
run_saf_audit_shallow_33SAF-MCP audit — 33 static techniques, synchronous$5.00
run_saf_audit_full_86SAF-MCP audit — all 86 techniques, live sandbox, async$49.00
get_saf_audit_statusPoll a run_saf_audit_full_86 job by job_idFree
run_saf_audit_full_86 has the same live-HTTP-endpoint requirement described in the REST API tab — it returns a job_id immediately; call get_saf_audit_status(job_id) to retrieve the result once ready (~4 minutes later).
Real x402 payment (not a placeholder): paid tools use the official x402 Python SDK. Calling one without payment returns a genuine PaymentRequired envelope (x402Version, accepts[] with the exact chain, USDC contract, amount, and recipient) as the tool result — the MCP-native equivalent of HTTP 402, verified live against the Coinbase-hosted facilitator at x402.org/facilitator. Defaults to Base Sepolia (testnet); set X402_NETWORK / X402_PAY_TO_ADDRESS for mainnet.