urlscan.io MCP server for AI agents and assistants

Securely connect your AI agents and chatbots (Claude, ChatGPT, Cursor, etc) with urlscan.io MCP or direct API to submit website scans, retrieve scan results, search threat data, and manage urlscan Pro resources through natural language.

urlscan.io logourlscan.io
Api Key

urlscan.io is a website scanning and threat intelligence platform for analyzing URLs, domains, IPs, and web behavior. It helps security teams investigate suspicious sites, detect phishing, and search rich scan data fast.

50 Tools

Try urlscan.io now

Type what you want done — sign in and watch it run live in the Tool Router playground.

TOOL ROUTER PLAYGROUND
urlscan.io
Try asking
TOOLS

Supported Tools

Every urlscan.io action and event your agent gets out of the box.

Close Incident

Stop ongoing scans for an active urlscan Pro incident and transition it to the closed state.

Copy Incident

Create a separate urlscan Pro incident from an existing incident's configuration.

Create Notification Channel

Create a Pro notification channel.

Create Incident

Create a Pro incident that persistently monitors an observable.

Run Blocking Live Scan

Run a temporary Live Scan synchronously and return only after the provider finishes the scan.

Create Live Scan Task

Start a non-blocking temporary Live Scan on a selected scanner and return its UUID immediately without waiting for completion.

Create Saved Search

Create a reusable scans or hostnames search definition.

Create Alert Subscription

Create a persistent scheduled or live alert subscription for saved searches.

Delete Scan Result

Permanently delete a scan owned by the connected user or team.

Delete Saved Search

Permanently delete a saved search by ID.

Delete Alert Subscription

Permanently delete an alert subscription by ID.

Download Captured File

Retrieve a captured binary file by its SHA-256 hash as a password-encrypted ZIP archive.

Fork Incident

Create a new Pro incident by copying an existing incident's configuration and complete stored state history.

Get Account Capabilities

Get non-sensitive plan, product, feature, visibility, submission, and limit information for the connected urlscan.

Get Brand Summary

Return detectable brands with detected-page totals and latest hits.

Get Notification Channel

Get one urlscan Pro notification channel by ID while preserving provider-specific metadata and removing webhook destinations or credentials.

Get Data Dump Download Link

Generate a temporary download URL for a path returned by LIST_DATA_DUMPS.

Get Scan DOM

Return the plain-text DOM snapshot captured for a completed scan.

Get Hostname History

Return one page of historical Pro Hostnames observations for a hostname.

Get Incident

Get one incident's configuration, source, runtime state, and timestamps.

Get Incident States

Retrieve the stored state history for an incident.

Get Live Scan Resource

Retrieve one temporary result, DOM, screenshot, captured response, or download from the separate urlscan.

Get API Quotas

Get current products, features, query capabilities, and per-action minute, hour, and day quota usage.

Get Captured Response Content

Return textual content captured in a scan response, addressed by its SHA-256 hash.

Get Scan Result

Retrieve the complete metadata and captured request data for a completed scan UUID.

Get Saved Search Results

Run a urlscan Pro saved search and return its current Search API results.

Get Scan Screenshot

Retrieve a completed urlscan.

Get Similar Scan Results

Find one page of scan results structurally similar to a specified scan.

Get Subscription Results

Resolve a urlscan Pro alert subscription and datasource to its current Search API results.

Get Available Brands

List brand identifiers and metadata tracked by urlscan.

Get Available Scan Countries

List scanner country codes currently accepted by the Scan API.

List Notification Channels

List email and webhook notification channels for the current user without returning webhook URLs or embedded credentials.

List Data Dumps

List available urlscan.

List Live Scanners

List Live Scanning nodes available to the connected account and their current metadata.

List Saved Searches

List saved searches owned by or shared with the current user.

List Alert Subscriptions

List alert subscriptions configured for the current user.

Get Scan User Agents

List grouped browser user-agent strings available for scan submission.

Get Watchable Incident Attributes

List attribute values accepted when configuring incident change monitoring.

Lookup Malicious Observable

Look up malicious-scan occurrence counts and first/last seen timestamps for an IP, hostname, domain, or exact URL.

Purge Live Scan Result

Permanently delete a temporary result from the separate urlscan.

Reset Scan Visibility

Remove an owned scan's visibility override and restore the visibility originally assigned at submission.

Restart Incident

Restart a closed urlscan Pro incident and extend its expiry.

Search Scans

Search urlscan.

Store Live Scan Result

Permanently store an existing temporary Live Scan result with the selected visibility.

Submit Scan

Submit a URL for asynchronous external scanning, creating persistent result state and consuming quota.

Update Notification Channel

Replace the complete configuration of an existing Pro notification channel.

Update Incident

Replace an existing incident's monitoring configuration and runtime options.

Update Scan Visibility

Change the visibility of a scan owned by the connected user or team.

Update Saved Search

Replace the complete definition and metadata of an existing saved search.

Update Alert Subscription

Replace the complete configuration of an existing alert subscription.

SETUP GUIDE

Connect urlscan.io MCP Tool with your Agent

1

Install Composio

typescript
npm install @composio/core ai @ai-sdk/mcp @ai-sdk/openai
Install the Composio SDK and your agent framework
2

Create a session with MCP enabled

typescript
import { Composio } from "@composio/core";

const composio = new Composio();
const { mcp } = await composio.create("your-user-id", {
  toolkits: ["urlscanio"],
  mcp: true,
});
Create a session scoped to urlscan.io and read its MCP URL and headers
3

Connect your agent to the MCP server

typescript
import { createMCPClient } from "@ai-sdk/mcp";
import { openai } from "@ai-sdk/openai";
import { generateText, stepCountIs } from "ai";

const client = await createMCPClient({
  transport: { type: "http", url: mcp.url, headers: mcp.headers },
});

const { text } = await generateText({
  model: openai("gpt-5.6-sol"),
  tools: await client.tools(),
  prompt: "Search urlscan.io for scans matching domain:example.com and summarize the latest results",
  stopWhen: stepCountIs(10),
});

console.log(text);
await client.close();
Pass the session's MCP URL and headers to your agent and run a urlscan.io request
SETUP GUIDE

Connect urlscan.io API Tool with your Agent

1

Install Composio

typescript
npm install @composio/core @composio/openai openai
Install the Composio SDK, the OpenAI provider, and the OpenAI SDK
2

Create a Composio session

typescript
import OpenAI from "openai";
import { Composio } from "@composio/core";
import { OpenAIResponsesProvider } from "@composio/openai";

const composio = new Composio({ provider: new OpenAIResponsesProvider() });
const client = new OpenAI();

const session = await composio.create("your-user-id", { toolkits: ["urlscanio"] });
const tools = await session.tools();
Initialize Composio with the OpenAI Responses provider and create a session scoped to urlscan.io
3

Run urlscan.io tools with your agent

typescript
let response = await client.responses.create({
  model: "gpt-5.6-sol",
  tools,
  input: [{ role: "user", content: "Search urlscan.io for scans matching domain:example.com and summarize the latest results" }],
});

while (response.output.some((o) => o.type === "function_call")) {
  const outputs = await composio.provider.handleToolCalls(session, response.output);
  response = await client.responses.create({
    model: "gpt-5.6-sol",
    tools,
    previous_response_id: response.id,
    input: outputs,
  });
}

console.log(response.output_text);
Send a request, execute the urlscan.io tool calls through the session, and print the final answer

Why Use Composio?

AI Native urlscan.io Integration

  • Supports both urlscan.io MCP and direct API based integrations
  • Structured, LLM-friendly schemas so agents can scan URLs and search results without brittle glue code
  • Rich coverage for submitting scans, retrieving reports, querying historical scan data, and working with urlscan Pro resources

Managed Auth

  • Secure API key handling for urlscan.io, so you don't have to hard-code secrets in agent code
  • Central place to manage, scope, and revoke urlscan.io access across users and environments
  • Use auth_configs.create() and connected_accounts.link() when configuring your own urlscan.io API key connection

Agent Optimized Design

  • Tools are tuned for AI agents, making tasks like “scan this suspicious URL” or “search for this phishing domain” simple and reliable
  • Comprehensive execution logs show what ran, when it ran, and on whose behalf
  • Use mcp.create() when you want to expose urlscan.io tools through an MCP server for agent frameworks

Enterprise Grade Security

  • Fine-grained RBAC so you control which agents and users can access urlscan.io
  • Scoped, least privilege access for URL scanning, search, and investigation workflows
  • Full audit trail of agent actions to support security review, incident response, and compliance
FAQ

Frequently asked questions

Yes, urlscan.io requires you to configure your own API key. Once set up, Composio handles secure credential storage and API request handling for you.

Yes! Composio's Tool Router enables agents to use multiple toolkits. Learn more.

Yes. Composio is SOC 2 Type II compliant and is built to keep your urlscan.io connection and credentials secure. OAuth tokens and API keys are encrypted, and sensitive customer data is protected at rest and in transit.

Composio also undergoes independent security testing and continuously monitors its systems for security threats. You can review the latest reports and policies in the Composio Trust Center.

Composio maintains and updates all toolkit integrations automatically, so your agents always work with the latest API versions.

Create the key in your urlscan.io account settings, then paste it once on Composio's connection page. Composio stores it encrypted and uses it only for the urlscan.io actions your agent runs. Nobody else in your workspace can read it, and you can revoke it inside urlscan.io at any time.

When you connect a urlscan.io account through Composio, every action runs under that account, so anything the agent creates, sends, or changes shows up in urlscan.io as done by you. Keep an approval step in your prompt for actions with side effects, such as sending or deleting, and have the agent draft first.

Whatever the credentials you connect allow inside urlscan.io. If urlscan.io lets you scope a key to specific permissions, create a scoped one so the agent can only do what you intend. You can revoke the key inside urlscan.io at any time.

Yes. Composio supports multiple connected accounts for the same app, and that works in Claude, ChatGPT, or any other assistant you connect through Composio. Give each urlscan.io connection a name such as work or personal, and the assistant uses the one you mention in the request. Each account keeps its own credentials and nothing is merged.

The connection stops working the moment urlscan.io rejects the old key. Create a new key in urlscan.io and reconnect the account from the Composio dashboard or by asking your agent to reconnect urlscan.io. Nothing else changes.

Composio's free Hobby plan includes 100,000 tool calls per month with no credit card, which covers most personal urlscan.io use. Paid plans add higher limits and team features. Your urlscan.io plan and its API limits still apply as usual.

Built-in connectors usually give one AI access to a limited set of apps. Many people use Composio because it lets their AI connect to more apps than it normally supports, or connect to multiple accounts for the same app (e.g. connect Claude to multiple urlscan.io accounts).

With Composio, you connect urlscan.io once and then use it across different AI assistants without setting it up separately in each one. Connect your apps to Composio once, then connect Composio to whichever AI you use, whether that's Claude, ChatGPT, Hermes, or your own custom assistant.

Start with urlscan.io.It takes 30 seconds.

Managed auth, hosted MCP servers, and every urlscan.io tool your agent needs.Free to start.

Start building