{"$schema":"https://wellknown.network/schemas/agent-record-v1.json","schemaVersion":"1","id":"ag_frucgzxn9cfa","handle":"api-key-scanner-mcp","url":"https://wellknown.network/agents/api-key-scanner-mcp","links":{"self":"https://wellknown.network/agents/api-key-scanner-mcp/record.json","html":"https://wellknown.network/agents/api-key-scanner-mcp","markdown":"https://wellknown.network/agents/api-key-scanner-mcp/record.md","api":"https://wellknown.network/api/v1/agents/api-key-scanner-mcp","status":"https://wellknown.network/api/v1/agents/api-key-scanner-mcp/status","claim":"https://wellknown.network/agents/api-key-scanner-mcp/claim","claimApi":"https://wellknown.network/api/v1/claims","claimDescriptor":"https://wellknown.network/agents/api-key-scanner-mcp/claim.json","badge":"https://wellknown.network/agents/api-key-scanner-mcp/badge.svg","openapi":"https://wellknown.network/openapi.json"},"ard":{"identifier":"urn:air::server:api-key-scanner-mcp","type":"application/mcp-server-card+json"},"kind":"mcp_server","declared":{"name":"api-key-scanner-mcp","summary":"Verify LLM API gateway authenticity. Local MCP server, your API key stays on your machine.","description":"# api-key-scanner\n\nVerify whether an LLM API gateway (or 中转站 / third-party proxy) is\nactually serving the model it claims — without ever handing your API\nkey to anyone else.\n\n**[简体中文](./README.zh-CN.md)**\n\n## How it works\n\nYou point the tool at an endpoint, tell it what model the gateway\nclaims to serve, and name the environment variable where your gateway\nAPI key lives. It runs a small probe set against the endpoint, compares\nthe responses to publicly-signed reference fingerprints of real vendor\nmodels, and returns a trust score.\n\nEverything runs on your machine. Your API key is read from a local env\nvar (never accepted in chat, never sent anywhere except the gateway you\nnamed). Reference fingerprints are downloaded from our GitHub Releases\nand Sigstore-verified before use — if the signature doesn't match the\nidentity of the GitHub Actions workflow that produced them, the tool\nrefuses the data and returns `inconclusive`.\n\nThe tool ships two pieces: an MCP server (on PyPI) and a skill that\nteaches the agent when and how to call the server's `verify_gateway`\ntool. Both pieces are platform-neutral; installation just differs per\nhost.\n\n## Prerequisites\n\nThe MCP server runs through [`uvx`](https://docs.astral.sh/uv/), which\nfetches and isolates the Python package on every launch. If you don't\nalready have `uv`, install it once:\n\n```bash\n# macOS\nbrew install uv\n\n# macOS / Linux (no Homebrew)\ncurl -LsSf https://astral.sh/uv/install.sh | sh\n\n# Windows (PowerShell)\nirm https://astral.sh/uv/install.ps1 | iex\n```\n\nAfter install, `uvx --version` should print a version. Restart your\nterminal (or your MCP client) if it doesn't show up yet.\n\n## Installation\n\n### Claude Code\n\nIn Claude Code:\n\n```\n/plugin marketplace add zhonghp/api-key-scanner\n/plugin install api-key-scanner@zhonghp-api-key-scanner\n```\n\nThat's everything — the plugin bundles the MCP server config and the\nskill. The server auto-downloads signed reference fingerprints on first\nuse; no manual bootstrap.\n\n### OpenCla…","publisher":{"name":"api-key-scanner contributors","url":null},"homepage":"https://github.com/zhonghp/api-key-scanner/tree/main/docs","repository":"https://github.com/zhonghp/api-key-scanner/tree/main/docs","version":"0.2.0","license":"Apache License\n                                   Version 2.0, …","protocols":["mcp"],"tags":["anthropic","api-verification","claude-code","llm","mcp","openai"],"pricing":null,"endpoints":[{"url":"pypi:api-key-scanner-mcp","type":"package_pypi","auth":null,"probeable":false}],"skills":null,"tools":null,"extra":null,"attribution":{"kind":"pypi","name":"pypi","license":"pypi","repoUrl":"pypi","summary":"pypi","version":"pypi","description":"pypi","homepageUrl":"pypi","publisherName":"pypi"}},"derived":{"capabilities":[{"slug":"security.scanning","name":"Security Scanning","confidence":1,"provenance":"derived"},{"slug":"dev.docs-lookup","name":"Documentation Lookup","confidence":0.791,"provenance":"derived"},{"slug":"dev.terminal","name":"Terminal & Shell","confidence":0.779,"provenance":"derived"},{"slug":"dev.package-management","name":"Packages & Dependencies","confidence":0.768,"provenance":"derived"}],"categories":["dev","security"],"language":"en"},"observed":{"status":"unknown","statusReason":"Distributed as a package to run locally; no network endpoint to check.","lastOkAt":null,"lastProbedAt":null,"statusComputedAt":null,"reliability30d":null,"latestObservations":[],"tools":null,"package":{"name":"api-key-scanner-mcp","registry":"pypi","observedAt":"2026-09-09T09:24:55.600Z","publishedAt":"2026-04-23T04:37:28.973488Z","latestVersion":"0.2.0"}},"verification":{"claimed":false,"claimedAt":null,"proofs":[]},"provenance":{"sources":[{"source":"pypi","key":"api-key-scanner-mcp","url":"https://pypi.org/project/api-key-scanner-mcp/","firstSeenAt":"2026-09-09T09:23:08.784Z","fetchedAt":"2026-09-09T09:23:08.784Z","normalizedAt":"2026-09-09T09:23:08.784Z"}]},"firstSeenAt":"2026-09-09T09:23:08.784Z","updatedAt":"2026-09-09T09:24:55.600Z"}