OnScanner API Docs | REST API & MCP Server for AI Agents

Reference

REST API

A JSON REST API to create scans, poll their status, and read structured reports. Authenticate every request with your API key in the ONSCANNER-KEY header.

Base URL

api.onscanner.com

Auth header

ONSCANNER-KEY

Format

JSON

Authenticated request

Replace <your-key> with a key from your dashboard.

curl

curl https://api.onscanner.com/me/ \
     -H "ONSCANNER-KEY: <your-key>"

Full API reference

Every public endpoint, with its request and response shape. Expand any endpoint to see parameters and try a live request with your API key.

Model Context Protocol

MCP server

OnScanner exposes an MCP server, so Claude, Cursor, and any MCP-compatible agent can start security & privacy scans, poll their status, and read structured findings on command, authenticated with your OnScanner API key.

Endpoint

mcp.onscanner.com/mcp

Transport

Streamable HTTP

Auth header

ONSCANNER-KEY

Create a key in your dashboard under API Keys (or sign up first). Replace <your-key> with that key.

Claude Code

terminal

claude mcp add onscanner --transport http https://mcp.onscanner.com/mcp \
  --header "ONSCANNER-KEY: <your-key>"

Claude Desktop, Cursor & VS Code

Add to your MCP config (e.g. ~/.cursor/mcp.json or .vscode/mcp.json):

mcp.json

{
  "mcpServers": {
    "onscanner": {
      "url": "https://mcp.onscanner.com/mcp",
      "headers": { "ONSCANNER-KEY": "<your-key>" }
    }
  }
}

If a client can't send custom headers, bridge with npx mcp-remote https://mcp.onscanner.com/mcp --header "ONSCANNER-KEY:<your-key>".

Anthropic API (MCP connector)

python

client.beta.messages.create(
    model="claude-opus-4-8", max_tokens=4096,
    betas=["mcp-client-2025-11-20"],
    mcp_servers=[{"type": "url", "url": "https://mcp.onscanner.com/mcp",
                  "name": "onscanner", "authorization_token": "<your-key>"}],
    tools=[{"type": "mcp_toolset", "mcp_server_name": "onscanner"}],
    messages=[{"role": "user", "content": "Scan example.com and summarize the findings."}],
)

Tools

Tool	What it does
list_targets	List the targets in your account.
create_target	Add a target you're authorized to scan.
get_target	Target details + scan history.
start_scan	Start a scan (async); returns a scan id.
list_scans	List recent scans.
get_scan_status	Poll a scan's status + summary.
get_scan_results	Full structured findings of a completed scan.

Typical flow: start_scan → poll get_scan_status until SCAN_COMPLETED → get_scan_results. You may only scan targets you own or are authorized to test.

Optional: guide your agent

The tools are self-describing, so no prompt is required. This short system prompt makes the async scan flow smoother:

system prompt

You can run OnScanner security & privacy scans via the onscanner MCP tools.
When asked to scan a site:
1. start_scan(domain), returns a scan_id immediately.
2. Poll get_scan_status(scan_id) until status is SCAN_COMPLETED (it runs async).
3. get_scan_results(scan_id) and summarize severity, top findings, CVEs, privacy issues.
Only scan domains the user owns or is authorized to test.

Build with OnScanner