Scanning

Scan Targets

Repository, local path, live URL, and pasted configuration behavior.

The target determines which evidence can exist. Aevrin shows unavailable coverage instead of pretending every input supports the full source pipeline.

Target	Where available	Coverage
Hosted repository URL	CLI, dashboard and Aevrin MCP (`scan_mcp_server`)	Clone to find the command that starts the server, then start it and run the MCP rules
Local directory	CLI	Same as a repository, without cloning
Public HTTPS MCP URL	CLI, dashboard and Aevrin MCP (`scan_mcp_server`)	Connect to the running server and run the MCP rules over the tools it offers; its code and packages are not read
Launch command (`aevrin scan mcp "<command>"`)	CLI, and the local `mcp-server` tool	Starts the server in a container on your machine, reads the tools it registers, and runs the MCP tool rules against them
Pasted MCP config JSON	Nowhere today	Aevrin cannot start a server from a config yet, so the dashboard no longer offers it

Repository URL

aevrin scan https://github.com/owner/mcp-server

Use a public HTTPS URL. Private repository authentication is not requested or stored by the scanner. Clone failure is reported as a failed stage, not as a clean report.

Local directory

cd /path/to/mcp-server
aevrin scan .

The path is resolved before scanner containers mount it read-only. On Windows, Docker Desktop must be allowed to share the drive containing the project.

Live server URL

aevrin scan https://tools.example.com/mcp

Only public HTTPS endpoints are accepted. Loopback, private, link-local, metadata, credential- bearing, and unsafe redirect destinations are rejected to prevent SSRF.

Launch command

aevrin scan mcp "npx -y @playwright/mcp"

Scans a server by the command that starts it. The command is parsed, never rewritten, and starts in an isolated container on your machine, so this target exists only in the CLI and in the local mcp-server tool: the hosted service never executes a submitted command.

It is the target that needs no guessing. Every other one has to be resolved to a launch command first, and resolving the wrong one grades a different package under this one's name. If you know the command your agent will run, scan that command.

With no container runtime available there is no sandbox to start the server in, and the scan is reported incomplete with no grade rather than as clean.

Pasted configuration

Not available. Aevrin cannot start a server from a pasted mcpServers config yet, so a scan of one would stop at the first step without checking anything. The dashboard no longer has the tab, and Aevrin MCP's scan_mcp_server refuses a config. Scan the server's code or its live URL instead, or, for the servers your own agents use, run aevrin agent scan --scan-servers.