BearScan MCP server

Get a key

Create one on the API keys page. It’s shown once; keep it in an environment variable or your client’s secret store, not in a file you commit.

Claude Code

claude mcp add --transport http bearscan https://mcp.bearscan.app \
  --header "Authorization: Bearer $BEARSCAN_API_KEY"

Cursor

// ~/.cursor/mcp.json, or .cursor/mcp.json in a project
{
  "mcpServers": {
    "bearscan": {
      "url": "https://mcp.bearscan.app",
      "headers": { "Authorization": "Bearer bs_live_..." }
    }
  }
}

VS Code

VS Code asks for the key the first time and stores it as a secret.

// .vscode/mcp.json
{
  "servers": {
    "bearscan": {
      "type": "http",
      "url": "https://mcp.bearscan.app",
      "headers": { "Authorization": "Bearer ${input:bearscan-key}" }
    }
  },
  "inputs": [
    { "id": "bearscan-key", "type": "promptString", "description": "BearScan API key", "password": true }
  ]
}

Claude Desktop

Claude Desktop’s connectors sign in with OAuth, which BearScan doesn’t offer yet. Until it does, connect through the mcp-remote bridge, which runs locally and adds the header:

// claude_desktop_config.json
{
  "mcpServers": {
    "bearscan": {
      "command": "npx",
      "args": [
        "-y", "mcp-remote", "https://mcp.bearscan.app",
        "--header", "Authorization: Bearer ${BEARSCAN_API_KEY}"
      ],
      "env": { "BEARSCAN_API_KEY": "bs_live_..." }
    }
  }
}

ChatGPT and claude.ai

Their custom connectors require OAuth and can’t send an API key, so they can’t connect yet. Use the REST API from an agent that can.

Tools

• scan_site: Starts a scan of a website and returns its id. Poll get_scan until it's complete.
• get_scan: A scan's status and its issue counts by severity.
• get_findings: Every issue a finished scan found, most severe first, with the pages it's on, how to fix it, and a prompt for a coding agent.
• get_report_markdown: The whole scan as one Markdown file, written for an agent to work through in a repository.

A key sees only its own workspace’s sites and scans. Free scans and paid reports have the same limits as in the dashboard.