Authentication

The MCP server authenticates each call via a Bearer API key.

Generate a key

Visit /settings/api-keys and click Generate key. The raw key (prefix ss_live_) is shown once.

Store the key

The MCP server reads the key from the SCANNER_API_KEY environment variable. In your editor config:

{
  "mcpServers": {
    "security-scanner": {
      "env": { "SCANNER_API_KEY": "ss_live_…" }
    }
  }
}

Revoke a key

From /settings/api-keys click Revoke next to any key. Revocation is instant — the next API call returns 401 invalid_api_key.

Errors

Security notes

• Keys are bcrypt-hashed at rest (cost 12).
• Raw keys are never logged — only the prefix + last 4 chars appear in audit logs.
• Each successful call updates last_used_at on the key row.