feat(039): hide scan buttons when no security scanners are enabled

Previously the Servers page, ServerDetail security tab, and Security
"Scan All" button were always visible regardless of whether any scanners
were actually installed. Clicking them just produced an error "no scanners
configured to run", which was a confusing dead end for users who hadn't
opted into security scanning.

Now scan-trigger UI is gated on the new SecurityOverview.ScannersEnabled
field — the count of scanners with status installed or configured (the
same set the engine actually runs).

Backend:
  - Add ScannersEnabled int field to SecurityOverview
  - Compute it in Service.GetOverview by filtering scanner status

Frontend:
  - New composable frontend/src/composables/useSecurityScannerStatus.ts
    that fetches /api/v1/security/overview once at app load and exposes
    a reactive hasEnabledScanners() helper. Module-scoped cache so all
    components share a single network call.
  - Servers.vue: gate "Scan All" header button
  - ServerDetail.vue: gate the "Security" tab itself and the "Scan Now"
    button inside the tab (defense-in-depth in case of deep links)
  - ServerCard.vue: gate the per-server "Scan" button
  - Security.vue: gate the "Scan All Servers" button using the existing
    overview response (which now includes scanners_enabled). Also calls
    refreshSecurityScannerStatus() after install/remove so other pages
    update immediately without a full reload.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: claude

frontend/src/components/ServerCard.vue

@@ -181,32 +181,34 @@
           Logout
         </button>
 
-        <div
-          v-if="!server.enabled"
-          class="tooltip tooltip-top"
-          data-tip="Enable server first"
-        >
-          <button
+        <template v-if="hasEnabledScanners()">
+          <div
+            v-if="!server.enabled"
+            class="tooltip tooltip-top"
+            data-tip="Enable server first"
+          >
+            <button
+              class="btn btn-sm btn-outline btn-ghost"
+              disabled
+            >
+              <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M9 12l2 2 4-4m5.618-4.016A11.955 11.955 0 0112 2.944a11.955 11.955 0 01-8.618 3.04A12.02 12.02 0 003 9c0 5.591 3.824 10.29 9 11.622 5.176-1.332 9-6.03 9-11.622 0-1.042-.133-2.052-.382-3.016z" />
+              </svg>
+              Scan
+            </button>
+          </div>
+          <router-link
+            v-else
+            :to="`/servers/${server.name}?tab=security`"
             class="btn btn-sm btn-outline btn-ghost"
-            disabled
+            title="Security Scan"
           >
             <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
               <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M9 12l2 2 4-4m5.618-4.016A11.955 11.955 0 0112 2.944a11.955 11.955 0 01-8.618 3.04A12.02 12.02 0 003 9c0 5.591 3.824 10.29 9 11.622 5.176-1.332 9-6.03 9-11.622 0-1.042-.133-2.052-.382-3.016z" />
             </svg>
             Scan
-          </button>
-        </div>
-        <router-link
-          v-else
-          :to="`/servers/${server.name}?tab=security`"
-          class="btn btn-sm btn-outline btn-ghost"
-          title="Security Scan"
-        >
-          <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
-            <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M9 12l2 2 4-4m5.618-4.016A11.955 11.955 0 0112 2.944a11.955 11.955 0 01-8.618 3.04A12.02 12.02 0 003 9c0 5.591 3.824 10.29 9 11.622 5.176-1.332 9-6.03 9-11.622 0-1.042-.133-2.052-.382-3.016z" />
-          </svg>
-          Scan
-        </router-link>
+          </router-link>
+        </template>
 
         <router-link
           :to="`/servers/${server.name}`"
@@ -262,6 +264,7 @@ import { ref, computed } from 'vue'
 import type { Server } from '@/types'
 import { useServersStore } from '@/stores/servers'
 import { useSystemStore } from '@/stores/system'
+import { useSecurityScannerStatus } from '@/composables/useSecurityScannerStatus'
 
 interface Props {
   server: Server
@@ -271,6 +274,7 @@ const props = defineProps<Props>()
 
 const serversStore = useServersStore()
 const systemStore = useSystemStore()
+const { hasEnabledScanners } = useSecurityScannerStatus()
 const loading = ref(false)
 const showDeleteConfirmation = ref(false)
 

frontend/src/composables/useSecurityScannerStatus.ts

@@ -0,0 +1,55 @@
+// Reactive composable that exposes whether any security scanner is currently
+// enabled. Used by Servers.vue, ServerDetail.vue, and other places that show
+// scan-trigger buttons — buttons should be hidden entirely when no scanner is
+// active.
+//
+// The result is cached at module scope so multiple components share a single
+// network call. Call refreshSecurityScannerStatus() after the user
+// installs/removes a scanner to update the state.
+
+import { ref } from 'vue'
+import api from '@/services/api'
+
+const enabledCount = ref<number | null>(null)
+const dockerAvailable = ref<boolean>(true)
+const loaded = ref(false)
+let inflight: Promise<void> | null = null
+
+export async function refreshSecurityScannerStatus(): Promise<void> {
+  if (inflight) {
+    return inflight
+  }
+  inflight = (async () => {
+    try {
+      const res = await api.getSecurityOverview()
+      const data: any = res?.data ?? {}
+      // Prefer the new scanners_enabled field; fall back to scanners_installed
+      // for backwards compatibility with older mcpproxy builds.
+      const enabled = data.scanners_enabled ?? data.scanners_installed ?? 0
+      enabledCount.value = typeof enabled === 'number' ? enabled : 0
+      dockerAvailable.value = data.docker_available !== false
+      loaded.value = true
+    } catch {
+      // On error, keep current values; the UI will fall back to dockerAvailable
+      // checks. We don't want a transient API blip to make all scan buttons
+      // disappear.
+    } finally {
+      inflight = null
+    }
+  })()
+  return inflight
+}
+
+export function useSecurityScannerStatus() {
+  if (!loaded.value && !inflight) {
+    void refreshSecurityScannerStatus()
+  }
+  return {
+    enabledCount,
+    dockerAvailable,
+    loaded,
+    /** True when at least one scanner is enabled and docker is available. */
+    hasEnabledScanners: () => (enabledCount.value ?? 0) > 0,
+    refresh: refreshSecurityScannerStatus,
+  }
+}

frontend/src/views/Security.vue

@@ -7,7 +7,11 @@
         <p class="text-base-content/70 mt-1">Configure security scanner plugins and review scan results</p>
       </div>
       <div class="flex gap-2">
-        <div class="tooltip" :data-tip="!overview?.docker_available ? 'Docker is required to run security scanners' : ''">
+        <div
+          v-if="(overview?.scanners_enabled ?? overview?.scanners_installed ?? 0) > 0"
+          class="tooltip"
+          :data-tip="!overview?.docker_available ? 'Docker is required to run security scanners' : ''"
+        >
           <button @click="startScanAll" :disabled="loading || scanAllRunning || !overview?.docker_available" class="btn btn-primary">
             <span v-if="scanAllRunning" class="loading loading-spinner loading-sm"></span>
             {{ scanAllRunning ? 'Scanning...' : 'Scan All Servers' }}
@@ -386,6 +390,7 @@
 <script setup lang="ts">
 import { ref, computed, watch, onMounted, onUnmounted } from 'vue'
 import api from '@/services/api'
+import { refreshSecurityScannerStatus } from '@/composables/useSecurityScannerStatus'
 
 const loading = ref(false)
 const error = ref('')
@@ -512,6 +517,9 @@ async function toggleScanner(scanner: any) {
       await api.removeScanner(scanner.id)
     }
     await refresh()
+    // Refresh shared scanner-status cache so other pages (Servers,
+    // ServerDetail) update their scan-button visibility immediately.
+    await refreshSecurityScannerStatus()
   } finally {
     installing.value = null
   }

frontend/src/views/ServerDetail.vue

@@ -214,6 +214,7 @@
           Configuration
         </button>
         <button
+          v-if="hasEnabledScanners()"
           :class="['tab tab-lg', activeTab === 'security' ? 'tab-active' : '']"
           @click="activeTab = 'security'; loadScannerNames(); loadScanReport()"
         >
@@ -501,8 +502,9 @@
           <div class="space-y-6">
             <!-- Header: Scan button + Risk Score -->
             <div class="flex flex-col sm:flex-row sm:justify-between sm:items-center gap-4">
-              <div class="tooltip" :data-tip="!dockerAvailable ? 'Docker is required to run security scanners' : ''">
+              <div class="tooltip" :data-tip="!dockerAvailable ? 'Docker is required to run security scanners' : (!hasEnabledScanners() ? 'No scanners enabled — install one from Security Scanners' : '')">
                 <button
+                  v-if="hasEnabledScanners()"
                   @click="startSecurityScan"
                   :disabled="scanLoading || !dockerAvailable"
                   class="btn btn-primary"
@@ -750,6 +752,7 @@ import AnnotationBadges from '@/components/AnnotationBadges.vue'
 import type { Hint } from '@/components/CollapsibleHintsPanel.vue'
 import type { Server, Tool, ToolApproval, SecurityScanReport } from '@/types'
 import api from '@/services/api'
+import { useSecurityScannerStatus } from '@/composables/useSecurityScannerStatus'
 
 interface Props {
   serverName: string
@@ -785,6 +788,7 @@ const quarantinedTools = computed(() => {
 
 // Security scan (Spec 039)
 const dockerAvailable = ref(true) // optimistic default until overview loads
+const { hasEnabledScanners } = useSecurityScannerStatus()
 const scanReport = ref<SecurityScanReport | null>(null)
 const scanStatus = ref<any>(null)
 const scanLoading = ref(false)

frontend/src/views/Servers.vue

@@ -19,6 +19,7 @@
           {{ serversStore.loading.loading ? 'Refreshing...' : 'Refresh' }}
         </button>
         <button
+          v-if="hasEnabledScanners()"
           @click="scanAllServers"
           :disabled="scanAllRunning"
           class="btn btn-primary btn-outline"
@@ -170,12 +171,14 @@ import api from '@/services/api'
 import ServerCard from '@/components/ServerCard.vue'
 import CollapsibleHintsPanel from '@/components/CollapsibleHintsPanel.vue'
 import type { Hint } from '@/components/CollapsibleHintsPanel.vue'
+import { useSecurityScannerStatus } from '@/composables/useSecurityScannerStatus'
 
 const serversStore = useServersStore()
 const systemStore = useSystemStore()
 const filter = ref<'all' | 'connected' | 'enabled' | 'quarantined'>('all')
 const searchQuery = ref('')
 const scanAllRunning = ref(false)
+const { hasEnabledScanners } = useSecurityScannerStatus()
 
 const filteredServers = computed(() => {
   let servers = serversStore.servers

internal/security/scanner/service.go

@@ -1129,10 +1129,18 @@ func (s *Service) GetSecurityOverview(ctx context.Context) (*SecurityOverview, e
 func (s *Service) GetOverview(ctx context.Context) (*SecurityOverview, error) {
 	overview := &SecurityOverview{}
 
-	// Count installed scanners
+	// Count installed scanners. ScannersInstalled is the total number of
+	// scanners persisted in storage; ScannersEnabled is the subset the engine
+	// will actually run (status installed or configured). UI uses
+	// ScannersEnabled to decide whether to show scan-trigger buttons.
 	scanners, err := s.storage.ListScanners()
 	if err == nil {
 		overview.ScannersInstalled = len(scanners)
+		for _, sc := range scanners {
+			if sc.Status == ScannerStatusInstalled || sc.Status == ScannerStatusConfigured {
+				overview.ScannersEnabled++
+			}
+		}
 	}
 
 	// Count scan jobs

internal/security/scanner/types.go

@@ -249,6 +249,7 @@ type SecurityOverview struct {
 	ActiveScans        int           `json:"active_scans"`
 	FindingsBySeverity ReportSummary `json:"findings_by_severity"`
 	ScannersInstalled  int           `json:"scanners_installed"`
+	ScannersEnabled    int           `json:"scanners_enabled"` // Subset of installed that the engine will run (status installed or configured)
 	ServersScanned     int           `json:"servers_scanned"`
 	LastScanAt         time.Time     `json:"last_scan_at,omitempty"`
 	DockerAvailable    bool          `json:"docker_available"`