Live, on-demand
web vulnerability & privacy scanning.

OnScanner is a web vulnerability scanner and website security scanner built by Byte Optimizer. It runs a stack of specialist engines in parallel against targets you own or are authorized to test, unauthenticated or authenticated: web vulnerability detection (OWASP Top 10, plus CVE/CPE version matching enriched with EPSS exploit-probability and CISA KEV known-exploited context), privacy and tracker analysis across 40+ categories, technology fingerprinting, DNS/TLS and WAF posture, and email security (DMARC, DKIM, SPF). Results are live and never cached, and are delivered as a structured report, a JSON API response, or a PDF. The scan itself never calls an LLM. Optional AI Findings, when you turn them on for a scan, send the results to a third-party AI provider to summarize, explain, prioritize, and check compliance.

OnScanner only scans targets that you explicitly add to your account. We perform non-intrusive analysis to help you identify security vulnerabilities and privacy risks before malicious actors do. All scans are authorized by the account owner. If you are the website owner and did not add it to our platform, please contact support@onscanner.com.

We offer three scan types: Security Scan (CVE detection, OWASP analysis, WAF fingerprinting), Privacy Scan (tracker detection, cookie analysis, consent evaluation), and Full Scan (comprehensive security + privacy analysis combined).

Each scan costs credits based on its type and options. A basic scan costs 1 credit, a full scan costs 2 credits, and advanced mode or subdomain scanning costs additional credits. Credits can be purchased individually or included in your subscription plan.

Yes. All scan data is encrypted in transit and at rest, stored securely, and only accessible to authorized users on your account. We do not sell your data. The one time scan results leave our systems is when you explicitly turn on AI Findings or AI compliance for a scan, which sends the findings to a third-party AI provider that is contractually prohibited from training on your data. With AI features off, nothing is shared with any third party.

Only if you choose to. AI features are optional and off by default, and the deterministic scan never uses an LLM. If you turn on AI analysis or AI compliance for a scan, your findings are sent to a third-party AI provider to generate the analysis. Payment data, login credentials, and raw screenshots are never sent, and the provider is contractually prohibited from using your data to train its models. Leave AI features off and no scan data is sent to any AI provider.

A privacy scan analyzes your website for third-party trackers, cookies, fingerprinting techniques, session recorders, and consent management compliance. It generates a privacy score and identifies specific tracking scripts from services like Google Analytics, Facebook Pixel, and more.

Yes! Professional and Enterprise plans include scheduled scanning. You can configure daily, weekly, or monthly automated scans on any of your targets. Continuous monitoring also provides 24/7 change detection.

Yes. OnScanner provides a full REST API and an MCP server that let you programmatically create scans, retrieve results, and manage targets. API keys can be generated from your dashboard.

Yes. OnScanner runs a Model Context Protocol (MCP) server at mcp.onscanner.com/mcp over Streamable HTTP, so Claude, Cursor, Claude Code, and any MCP-compatible AI agent can drive scans directly. Authenticate by sending your OnScanner API key in the ONSCANNER-KEY header (or as a Bearer token). The server exposes seven tools: list_targets, create_target, get_target, start_scan, list_scans, get_scan_status, and get_scan_results. A typical agent flow is create_target, start_scan, poll get_scan_status until SCAN_COMPLETED, then get_scan_results. Usage is billed in the same per-scan credits as the web app, and you may only scan targets you own or are authorized to test. See the MCP guide.

You can purchase additional credits at any time, or enable auto-refill to automatically top up your balance when it drops below a threshold. Scheduled scans will pause if your credit balance is insufficient.

OnScanner combines specialist engines covering security, privacy, technology fingerprinting, WAF, CVE/CPE matching, DNS, email security, and infrastructure into one platform with live, never-cached results, across unauthenticated and authenticated scans, rather than a single generic crawler. Findings are prioritized with EPSS exploit-probability and CISA KEV context and checked for patch status and end-of-life, so you can tell a genuinely exploitable issue from noise. It is built for automation: a full REST API and an MCP server let Claude, Cursor, and other AI agents run scans directly. The scan itself never calls an LLM, and optional AI Findings can summarize, correlate, and assess compliance on the results when you turn them on.

Yes. Enterprise plans support team accounts with role-based access control (Owner, Member, Viewer roles), custom credit allotments, dedicated support, and SLA guarantees. Contact our sales team for a custom quote.

You can reach our support team through the contact form below, or by submitting a support ticket from your dashboard. Professional and Enterprise customers receive priority support with faster response times.