add_monitor

Put a site the user owns under continuous monitoring: hourly uptime checks, CVE matching, certificate alerts and regular rescans. Runs a full baseline scan straight away, which uses one of the user's scans exactly as in the app (free for plan holders). Returns the baseline scan_id for get_scan_status.

Argument	Type	Description
url*	string	The site to monitor, e.g. https://example.com

Input schema (JSON)

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "url"
  ],
  "properties": {
    "url": {
      "type": "string",
      "maxLength": 2048,
      "minLength": 1,
      "description": "The site to monitor, e.g. https://example.com"
    }
  },
  "additionalProperties": false
}

check_domain_verification

Check whether the file or DNS record from start_domain_verification is live. On success the domain is verified and its next scan includes active tests. DNS changes can take a few minutes.

Argument	Type	Description
domain*	string	The domain passed to start_domain_verification

Input schema (JSON)

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "domain"
  ],
  "properties": {
    "domain": {
      "type": "string",
      "maxLength": 253,
      "minLength": 1,
      "description": "The domain passed to start_domain_verification"
    }
  },
  "additionalProperties": false
}

dismiss_finding

Mark a finding as a false positive for this site, so future scans of it stop reporting it — the same as Dismiss in the app, and undoable there. ONLY use this after the user has confirmed the finding is wrong; never dismiss a real problem to improve a grade.

destructive

Argument	Type	Description
scan_id*	string	The scan whose report contains the finding
finding_name*	string	The finding's name exactly as get_report shows it

Input schema (JSON)

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "scan_id",
    "finding_name"
  ],
  "properties": {
    "scan_id": {
      "type": "string",
      "description": "The scan whose report contains the finding"
    },
    "finding_name": {
      "type": "string",
      "maxLength": 300,
      "minLength": 1,
      "description": "The finding's name exactly as get_report shows it"
    }
  },
  "additionalProperties": false
}

get_account

How many scans the user can still run — free scans, plan scans and credits — and their plan. Check this before starting several scans.

read-only

No arguments.

Input schema (JSON)

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "properties": {}
}

get_report

The finished report for a scan: grade, what the scan tested and what it skipped (a clean grade says nothing about skipped areas, so say so), prioritised findings with fixes and evidence, and a fix prompt written for the user's AI editor. Findings come 25 per page, most severe first — pass offset for the next page, or min_severity (e.g. "high") to focus on what matters most.

read-only

Argument	Type	Description
limit	integer	Findings per page (default 25, max 50)
offset	integer	Skip this many findings, for the next page
scan_id*	string	The scan_id returned by scan_url or list_recent_scans
min_severity	string	Only findings at this severity or worse, e.g. "high"

Input schema (JSON)

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "scan_id"
  ],
  "properties": {
    "limit": {
      "type": "integer",
      "maximum": 50,
      "minimum": 1,
      "description": "Findings per page (default 25, max 50)"
    },
    "offset": {
      "type": "integer",
      "minimum": 0,
      "description": "Skip this many findings, for the next page"
    },
    "scan_id": {
      "type": "string",
      "description": "The scan_id returned by scan_url or list_recent_scans"
    },
    "min_severity": {
      "enum": [
        "critical",
        "high",
        "medium",
        "low",
        "info"
      ],
      "type": "string",
      "description": "Only findings at this severity or worse, e.g. \"high\""
    }
  },
  "additionalProperties": false
}

get_scan_status

Status of a scan (queued, scanning, analyzing, complete, failed). With wait_seconds (max 60) it waits for the scan to finish and returns the full report as soon as it does.

read-only

Argument	Type	Description
scan_id*	string	The scan_id returned by scan_url
wait_seconds	integer	Wait up to this long for the scan to finish

Input schema (JSON)

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "scan_id"
  ],
  "properties": {
    "scan_id": {
      "type": "string",
      "description": "The scan_id returned by scan_url"
    },
    "wait_seconds": {
      "type": "integer",
      "maximum": 60,
      "minimum": 0,
      "description": "Wait up to this long for the scan to finish"
    }
  },
  "additionalProperties": false
}

list_monitors

Sites under continuous monitoring: latest grade, last and next scan, uptime check, CVE alerts, new problems in the last scan and certificate expiry. Use the monitor id with monitor_scan_now.

read-only

No arguments.

Input schema (JSON)

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "properties": {}
}

list_recent_scans

The user's most recent scans with their status, newest first.

read-only

Argument	Type	Description
limit	integer

Input schema (JSON)

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "properties": {
    "limit": {
      "type": "integer",
      "maximum": 25,
      "minimum": 1
    }
  },
  "additionalProperties": false
}

list_verified_domains

Domains the user has proved they own. Only these receive active testing (injection, XSS, SSRF, access control); others get passive checks. Verify more at https://secscan.us/domains.

read-only

No arguments.

Input schema (JSON)

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "properties": {}
}

monitor_scan_now

Run a full scan of a monitored site now instead of waiting for its schedule — e.g. to confirm a fix. Free for plan holders; otherwise uses one of the user's scans, as in the app. Takes the monitor id from list_monitors.

Argument	Type	Description
monitor_id*	string	The monitor id from list_monitors or add_monitor

Input schema (JSON)

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "monitor_id"
  ],
  "properties": {
    "monitor_id": {
      "type": "string",
      "description": "The monitor id from list_monitors or add_monitor"
    }
  },
  "additionalProperties": false
}

scan_url

Start a SecScan security scan of a web application the user owns or is authorised to test. Returns a scan_id; most scans finish in under a minute — then call get_scan_status with wait_seconds, or get_report. Active tests (injection, XSS, SSRF…) run only on domains the user has verified; others get passive checks. Optionally also reads a GitHub repository's source (github_repo): any public one, or a private one the user connected at secscan.us. That only contacts GitHub, never the site. Each scan uses one of the user's free scans, plan scans or credits.

Argument	Type	Description
url*	string	The URL to scan, e.g. https://example.com
github_repo	string	Optional GitHub repository to read, e.g. https://github.com/owner/repo. Public, or private if the user connected it under Connect GitHub on secscan.us.

Input schema (JSON)

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "url"
  ],
  "properties": {
    "url": {
      "type": "string",
      "maxLength": 2048,
      "minLength": 1,
      "description": "The URL to scan, e.g. https://example.com"
    },
    "github_repo": {
      "type": "string",
      "maxLength": 300,
      "description": "Optional GitHub repository to read, e.g. https://github.com/owner/repo. Public, or private if the user connected it under Connect GitHub on secscan.us."
    }
  },
  "additionalProperties": false
}

start_domain_verification

Begin proving the user owns a domain, which unlocks active tests (injection, XSS, SSRF, access control) on its scans. Returns a file to publish on the site, or a DNS TXT record — an editor can usually add the file to the codebase and deploy it. Then call check_domain_verification. Calling it again returns the same token, so a record already published stays valid.

Argument	Type	Description
domain*	string	The domain, e.g. example.com or https://example.com

Input schema (JSON)

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "domain"
  ],
  "properties": {
    "domain": {
      "type": "string",
      "maxLength": 253,
      "minLength": 1,
      "description": "The domain, e.g. example.com or https://example.com"
    }
  },
  "additionalProperties": false
}

SecScan

Try it

add_monitor

SecScan

Try it

add_monitor

Tools (12)