For developers

API, CLI and MCP server

The same checks as the website, without a key or an account. Read-only, nothing about you stored, free to use. Rate limits are per IP address.

REST API

Base URL https://security.msrx.co.in/api/v1. JSON in, JSON out, CORS open so you can call it from a browser. Errors look like { "error": { "code", "message" } }. The OpenAPI 3.1 file is at /api/v1/openapi.json.

GET /api/v1/scan

Passive security scan of a public website: score out of 10, grade, ranked fixes and detected software with known CVEs.

Limit: 6 per 10 minutes

url *: Web address, e.g. example.com (query)

curl "https://security.msrx.co.in/api/v1/scan?url=example.com"

GET /api/v1/cve/{id}

One vulnerability: description, CVSS scores, CISA KEV exploitation status, EPSS probability, affected products and fixed versions.

Limit: 30 per minute

id *: CVE-2021-44228 or a GHSA id (path)

curl "https://security.msrx.co.in/api/v1/cve/CVE-2021-44228"

GET /api/v1/cve/search

Newest CVEs that mention a product or keyword.

Limit: 30 per minute

q *: 3 to 80 characters, e.g. fortigate (query)

curl "https://security.msrx.co.in/api/v1/cve/search?q=fortigate"

GET /api/v1/kev

Vulnerabilities CISA confirmed as exploited in the wild, newest first.

Limit: 30 per minute

days: Look back 1 to 365 days. Default 30. (query)
q: Search CVE, vendor, product or description (query)
vendor: Filter by vendor name (query)
ransomware: 1 to show only those used in ransomware (query)
limit: 1 to 500. Default 100. (query)

curl "https://security.msrx.co.in/api/v1/kev?days=30&ransomware=1"

GET /api/v1/link

Take a link apart: look-alike letters, IP hosts, hidden user@ tricks, shorteners, risky domains. The link is never visited.

Limit: 60 per minute

url *: The link to inspect (query)

curl -G "https://security.msrx.co.in/api/v1/link" --data-urlencode "url=https://www.paypal.com.account-verify.example.top/login"

GET /api/v1/qr

Explain what the text inside a QR code does (UPI payment, link, Wi-Fi, 2FA secret, app install).

Limit: 60 per minute

text *: The decoded QR contents (query)

curl -G "https://security.msrx.co.in/api/v1/qr" --data-urlencode "text=upi://pay?pa=refund@oksbi&am=4999"

POST /api/v1/scam

Pattern check of an SMS, WhatsApp message or call script for known scam scripts. Never returns "safe".

Limit: 30 per 10 minutes

message *: 15 to 2000 characters (body)

curl -X POST "https://security.msrx.co.in/api/v1/scam" -H "content-type: application/json" -d '{"message":"Your KYC is expired. Share the OTP now or your account will be blocked."}'

Command line

One file, no install, Node 18 or newer. It calls the API above.

curl -O https://security.msrx.co.in/msrx-sec.mjs node msrx-sec.mjs scan example.com node msrx-sec.mjs cve CVE-2021-44228 node msrx-sec.mjs kev --days 30 --ransomware node msrx-sec.mjs link "https://paypal.com.verify.example.top/login"

Add --json for raw output. scan --fail-under 7 exits with code 2 when the score is lower, for CI.

Check a site in CI

A weekly job that fails when your score drops. Scan only sites you own or are allowed to assess.

# .github/workflows/security-score.yml name: Security score on: schedule: [{ cron: "0 6 * * 1" }] workflow_dispatch: jobs: score: runs-on: ubuntu-latest steps: - name: Fail if the site scores below 7 run: | curl -fsS https://security.msrx.co.in/msrx-sec.mjs -o msrx-sec.mjs node msrx-sec.mjs scan example.com --fail-under 7

MCP server for AI assistants

Lets Claude and other MCP clients scan a site, look up a CVE, list what is being exploited, and check links, QR contents and scam messages. Remote, read-only, no authentication.

claude mcp add --transport http msrx-security https://security.msrx.co.in/api/mcp

Or in a client's JSON config:

{ "mcpServers": { "msrx-security": { "type": "http", "url": "https://security.msrx.co.in/api/mcp" } } }

Tools: scan_website, lookup_cve, search_cves, recent_exploited_vulnerabilities, inspect_link, explain_qr_contents, check_scam_message.

Fair use and limits

Keep to the rate limits and cache results. The scanner makes ordinary passive requests to the site you name, so scan only your own sites or ones you are allowed to assess. Results are guidance only, and the service is provided without warranty and with zero liability, as set out in the terms. We do not log who calls the API or what they ask; see the privacy page.