AevrinScan Targets
Repository, local path, live URL, and pasted configuration behavior.
The target determines which evidence can exist. Aevrin shows unavailable coverage instead of pretending every input supports the full source pipeline.
| Target | Where available | Coverage |
|---|---|---|
| Hosted repository URL | CLI and dashboard | Clone, static analysis, secrets, dependencies, and tool descriptions when an entrypoint is discoverable |
| Local directory | CLI | Same source pipeline without cloning |
| Public HTTPS MCP URL | CLI and dashboard config | Safe remote tool-description inspection only |
| Pasted MCP config JSON | Dashboard and hook | Inspect declared public endpoints; submitted stdio commands are never executed |
Repository URL
aevrin scan https://github.com/owner/mcp-serverUse a public HTTPS URL. Private repository authentication is not requested or stored by the scanner. Clone failure is reported as a failed stage, not as a clean report.
Local directory
cd /path/to/mcp-server
aevrin scan .The path is resolved before scanner containers mount it read-only. On Windows, Docker Desktop must be allowed to share the drive containing the project.
Live server URL
aevrin scan https://tools.example.com/mcpOnly public HTTPS endpoints are accepted. Loopback, private, link-local, metadata, credential- bearing, and unsafe redirect destinations are rejected to prevent SSRF.
Pasted configuration
Paste a JSON object containing mcpServers in New scan. Aevrin redacts config contents before
storage. Remote URLs can be inspected; stdio commands are treated as declarations and are never
executed by the hosted service.