Dashboard

varq.aevrin.ai/dashboard is where every scan lands, regardless of where it came from. The CLI, the dashboard's own scan form and an agent using Aevrin MCP's scan_mcp_server all write to the same scans table and render through the same scan-detail page.

Starting a scan from the dashboard

The dashboard can scan two kinds of target: a link to an MCP server's code on GitHub, or the https link of an MCP server that is running now. Sign in, paste the link, and it runs the identical pipeline the CLI runs, server-side, with live stage-by-stage progress while it's running. A GitHub link must be a real MCP server: Aevrin finds the package the code publishes and starts that. A pasted MCP config cannot be scanned, because Aevrin cannot start a server from a config yet.

Reading a scan result

Every scan page shows:

• Score and verdict. See Concepts → Risk score and grade.
• Per-stage results. Resolving, launching, enumerating, analyzing and grading, each with a status icon. A scan flagged incomplete shows a destructive-styled banner naming exactly which stages couldn't finish, and the score is explicitly labeled "not a reliable result" instead of a clean verdict.
• Findings list. Searchable and filterable by severity and triage status, with each row linking to a detail page containing the full description, exact file/line, remediation, and auditable false-positive workflow.
• Coverage notes. What this scan format does not test (currently MCP08, prompt injection via live tool responses), shown as an explicit note rather than omitted.
• "This code is not an MCP server." when Aevrin read the code and found no MCP server: no package it could start and no MCP SDK. The scan stops there, with no grade and no findings, because Aevrin checks MCP servers only. A repository that uses an MCP SDK but publishes nothing Aevrin can start, or that holds several servers, is told exactly that instead, and a repository that could not be fetched says nothing about the code.
• A public report from an earlier scan, only when this scan could not finish and a public report exists for the same npm package or GitHub repository. It is shown in its own card and is someone else's earlier result: it never changes this scan's grade or findings, and this scan still says it did not finish.
• Download full report (JSON). The scan engine's own complete report for this scan: every tool it read, each finding with its evidence, the score and any errors. A scan from before this was kept, or one whose report was over 1 MB, has none, and the page says so.
• AI second look, on a finished scan with findings. Click Run AI review and your own AI provider looks at each finding again. Each finding then shows a chip, AI: likely real, AI: maybe not real or AI: not sure, and the finding page shows the AI's reason in its own card. The AI can be wrong, and it never changes a finding or the grade. It uses the AI provider you added under Settings, and your key never enters the scan's sandbox. See AI explanations.

CLI-originated results carry a visible note: the scan ran on your computer, and Aevrin checked the upload and saved it as it was. Aevrin did not scan the target again or grade it again. See Concepts → Self-reported results for exactly what that does and doesn't mean.

Usage meters

The dedicated Usage page shows your credit balance against the plan's monthly allowance, resetting on a rolling window from your signup date, what each action costs, and activity counts per surface. Its activity ledger lists the latest 50 charged scans with source filters, timestamp, status, score, target type, and a link to the full report. See Concepts → Credits & tiers for the exact numbers per plan.

History and deletion

Scan history lists dashboard and CLI reports together. Scans started by the retired Claude Code hook stay in history, labelled Claude Code hook (retired). Delete one report from its row, or use Clear history to remove every owned scan after confirmation. Deletion cascades to that scan's stages and findings; it does not refund credits already spent.

Finding review

Finding detail supports open, fixed, and false_positive triage. False-positive reports require a review reason, and the reason plus triage timestamp remain visible in the report and printable export. See Triage and False Positives.

API keys

Settings → API Keys lets you mint additional long-lived keys for automation contexts where aevrin login's interactive browser flow is not practical, such as CI pipelines and scheduled jobs. These are separate from (and in addition to) the key aevrin login stores locally on your own machine.

Export

Scan details can export an OWASP MCP-mapped HTML report with a browser Print / Save as PDF action. The export retains coverage, active and resolved findings, and false-positive triage reasons.