REST API
A JSON REST API to create scans, poll their status, and read structured reports. Authenticate every request with your API key in the ONSCANNER-KEY header.
Authenticated request
Replace <your-key> with a key from your dashboard.
curl https://api.onscanner.com/targets/ \ -H "ONSCANNER-KEY: <your-key>"
Full API reference
Every public endpoint, with its request and response shape. Expand any endpoint to see parameters and try a live request with your API key.
MCP server
OnScanner exposes an MCP server, so Claude, Cursor, and any MCP-compatible agent can start security & privacy scans, poll their status, and read structured findings on command, authenticated with your OnScanner API key.
Create a key in your dashboard under API Keys (or sign up first). Replace <your-key> with that key.
Claude Code
claude mcp add onscanner --transport http https://mcp.onscanner.com/mcp \ --header "ONSCANNER-KEY: <your-key>"
Claude Desktop, Cursor & VS Code
Add to your MCP config (e.g. ~/.cursor/mcp.json or .vscode/mcp.json):
{
"mcpServers": {
"onscanner": {
"url": "https://mcp.onscanner.com/mcp",
"headers": { "ONSCANNER-KEY": "<your-key>" }
}
}
}If a client can't send custom headers, bridge with npx mcp-remote https://mcp.onscanner.com/mcp --header "ONSCANNER-KEY:<your-key>".
Anthropic API (MCP connector)
client.beta.messages.create(
model="claude-opus-4-8", max_tokens=4096,
betas=["mcp-client-2025-11-20"],
mcp_servers=[{"type": "url", "url": "https://mcp.onscanner.com/mcp",
"name": "onscanner", "authorization_token": "<your-key>"}],
tools=[{"type": "mcp_toolset", "mcp_server_name": "onscanner"}],
messages=[{"role": "user", "content": "Scan example.com using OnScanner and summarize the findings."}],
)Tools
| Tool | What it does |
|---|---|
| list_targets | List the targets in your account. |
| create_target | Add a target you're authorized to scan. |
| get_target | Target details + scan history. |
| start_scan | Start a scan (async); returns a scan id. |
| list_scans | List recent scans. |
| get_scan_status | Poll a scan's status + summary. |
| get_scan_results | Full structured findings of a completed scan. |
| get_scan_ai_analysis | AI analysis of a scan, when it was enabled. |
Typical flow: start a scan, poll its status until it reports SCAN_COMPLETED, then read the results. Use deep mode for a wider, browser-driven crawl, and authenticated scanning (one-time cookie / bearer / basic credentials, or a login saved on the target) to reach pages behind a login. You may only scan targets you own or are authorized to test.
Example prompts
Once the server is connected, just ask your agent in plain language. Naming OnScanner keeps it unambiguous when you have other tools connected. For example:
- "Use OnScanner to scan example.com and summarize the security findings."
- "Use OnScanner to run an advanced scan of example.com and check for known exploits."
- "Use OnScanner to run a deep scan of example.com, including its subdomains."
- "Use OnScanner to run a privacy scan of example.com and tell me whether the cookie banner is honored."
- "Use OnScanner to scan the login-protected area of example.com with my saved login and flag anything exposed."
- "Use OnScanner to run a full scan of example.com with AI analysis and give me prioritized fixes."
Optional: guide your agent
The tools are self-describing, so no prompt is required. These short system prompts nudge the agent for common cases. Copy whichever fits:
You can run OnScanner external security and privacy scans through the onscanner MCP tools. To scan a site, pick or create a target, start the scan, then wait for it to finish (scans run asynchronously, so check the status until it reports completed) and read the results. Summarize severity, the top findings, matched CVEs, and privacy issues. Only scan sites the user owns or is authorized to test.
For a more thorough assessment, run the scan in deep mode: it drives a real browser, crawls more widely, and surfaces more findings. It takes longer and costs more credits, so use it when the user asks for a deep or comprehensive scan. Otherwise the default quick mode is fine.
To scan pages behind a login, run an authenticated scan. For a simple login, supply one-time credentials with the scan (a session cookie, a bearer token, or basic auth). For a login that uses a form, SSO, or 2FA, ask the user to save the login on the target in the OnScanner app first, then run the scan reusing that saved login. Authenticated scans run against a single host, not subdomains. Never scan behind a login without the owner's permission.
For a privacy review, run a privacy scan and summarize third-party trackers, advertising pixels, browser fingerprinting, cookies, and whether the consent banner is honored. Group findings by category and flag anything that contradicts the site's stated privacy policy.