urlscan.io MCP for AI Agents

Securely connect your AI agents and chatbots (Claude, ChatGPT, Cursor, etc) with urlscan.io MCP or direct API to submit website scans, retrieve scan results, search threat data, and manage urlscan Pro resources through natural language.

urlscan.io logourlscan.io
Api Key

urlscan.io is a website scanning and threat intelligence platform for analyzing URLs, domains, IPs, and web behavior. It helps security teams investigate suspicious sites, detect phishing, and search rich scan data fast.

50 Tools

Try urlscan.io now

Type what you want done — sign in and watch it run live in the Tool Router playground.

TOOL ROUTER PLAYGROUND
urlscan.io
Try asking
TOOLS

Supported Tools

Every urlscan.io action and event your agent gets out of the box.

Close Incident

Stop ongoing scans for an active urlscan Pro incident and transition it to the closed state.

Copy Incident

Create a separate urlscan Pro incident from an existing incident's configuration.

Create Notification Channel

Create a Pro notification channel.

Create Incident

Create a Pro incident that persistently monitors an observable.

Run Blocking Live Scan

Run a temporary Live Scan synchronously and return only after the provider finishes the scan.

Create Live Scan Task

Start a non-blocking temporary Live Scan on a selected scanner and return its UUID immediately without waiting for completion.

Create Saved Search

Create a reusable scans or hostnames search definition.

Create Alert Subscription

Create a persistent scheduled or live alert subscription for saved searches.

Delete Scan Result

Permanently delete a scan owned by the connected user or team.

Delete Saved Search

Permanently delete a saved search by ID.

Delete Alert Subscription

Permanently delete an alert subscription by ID.

Download Captured File

Retrieve a captured binary file by its SHA-256 hash as a password-encrypted ZIP archive.

Fork Incident

Create a new Pro incident by copying an existing incident's configuration and complete stored state history.

Get Account Capabilities

Get non-sensitive plan, product, feature, visibility, submission, and limit information for the connected urlscan.

Get Brand Summary

Return detectable brands with detected-page totals and latest hits.

Get Notification Channel

Get one urlscan Pro notification channel by ID while preserving provider-specific metadata and removing webhook destinations or credentials.

Get Data Dump Download Link

Generate a temporary download URL for a path returned by LIST_DATA_DUMPS.

Get Scan DOM

Return the plain-text DOM snapshot captured for a completed scan.

Get Hostname History

Return one page of historical Pro Hostnames observations for a hostname.

Get Incident

Get one incident's configuration, source, runtime state, and timestamps.

Get Incident States

Retrieve the stored state history for an incident.

Get Live Scan Resource

Retrieve one temporary result, DOM, screenshot, captured response, or download from the separate urlscan.

Get API Quotas

Get current products, features, query capabilities, and per-action minute, hour, and day quota usage.

Get Captured Response Content

Return textual content captured in a scan response, addressed by its SHA-256 hash.

Get Scan Result

Retrieve the complete metadata and captured request data for a completed scan UUID.

Get Saved Search Results

Run a urlscan Pro saved search and return its current Search API results.

Get Scan Screenshot

Retrieve a completed urlscan.

Get Similar Scan Results

Find one page of scan results structurally similar to a specified scan.

Get Subscription Results

Resolve a urlscan Pro alert subscription and datasource to its current Search API results.

Get Available Brands

List brand identifiers and metadata tracked by urlscan.

Get Available Scan Countries

List scanner country codes currently accepted by the Scan API.

List Notification Channels

List email and webhook notification channels for the current user without returning webhook URLs or embedded credentials.

List Data Dumps

List available urlscan.

List Live Scanners

List Live Scanning nodes available to the connected account and their current metadata.

List Saved Searches

List saved searches owned by or shared with the current user.

List Alert Subscriptions

List alert subscriptions configured for the current user.

Get Scan User Agents

List grouped browser user-agent strings available for scan submission.

Get Watchable Incident Attributes

List attribute values accepted when configuring incident change monitoring.

Lookup Malicious Observable

Look up malicious-scan occurrence counts and first/last seen timestamps for an IP, hostname, domain, or exact URL.

Purge Live Scan Result

Permanently delete a temporary result from the separate urlscan.

Reset Scan Visibility

Remove an owned scan's visibility override and restore the visibility originally assigned at submission.

Restart Incident

Restart a closed urlscan Pro incident and extend its expiry.

Search Scans

Search urlscan.

Store Live Scan Result

Permanently store an existing temporary Live Scan result with the selected visibility.

Submit Scan

Submit a URL for asynchronous external scanning, creating persistent result state and consuming quota.

Update Notification Channel

Replace the complete configuration of an existing Pro notification channel.

Update Incident

Replace an existing incident's monitoring configuration and runtime options.

Update Scan Visibility

Change the visibility of a scan owned by the connected user or team.

Update Saved Search

Replace the complete definition and metadata of an existing saved search.

Update Alert Subscription

Replace the complete configuration of an existing alert subscription.

SETUP GUIDE

Connect urlscan.io MCP Tool with your Agent

1

Install Composio

typescript
npm install @composio/core ai @ai-sdk/openai @ai-sdk/mcp
Install the Composio SDK for Python or TypeScript
2

Initialize Client and Create Tool Router Session

typescript
import { Composio } from '@composio/core';

const composio = new Composio({ apiKey: 'your-api-key' });
const session = await composio.create('your-user-id');
console.log(`Tool Router session created: ${session.mcp.url}`);
Import and initialize the Composio client, then create a Tool Router session for urlscan.io
3

Connect to AI Agent

typescript
import { openai } from '@ai-sdk/openai';
import { experimental_createMCPClient as createMCPClient } from '@ai-sdk/mcp';
import { generateText } from 'ai';

const client = await createMCPClient({
  transport: {
    type: 'http',
    url: session.mcp.url,
    headers: {
      'x-api-key': 'your-composio-api-key',
    },
  },
});

const tools = await client.tools();
const { text } = await generateText({
  model: openai('gpt-4o'),
  tools,
  messages: [{
    role: 'user',
    content: 'Submit https://example.com to urlscan.io and summarize the scan results'
  }],
  maxSteps: 5,
});

console.log(`Agent: ${text}`);
Use the MCP server with your AI agent (Anthropic Claude or Mastra)
SETUP GUIDE

Connect urlscan.io API Tool with your Agent

1

Install Composio

typescript
npm install @composio/openai
Install the Composio SDK
2

Initialize Composio and Create Tool Router Session

typescript
import OpenAI from 'openai';
import { Composio } from '@composio/core';
import { OpenAIResponsesProvider } from '@composio/openai';

const composio = new Composio({
  provider: new OpenAIResponsesProvider(),
});
const openai = new OpenAI({});
const session = await composio.create('your-user-id');
Import and initialize Composio client, then create a Tool Router session
3

Execute urlscan.io Tools via Tool Router with Your Agent

typescript
const tools = session.tools;
const response = await openai.responses.create({
  model: 'gpt-4.1',
  tools: tools,
  input: [{
    role: 'user',
    content: 'Search urlscan.io for scans matching domain:example.com and summarize the latest results'
  }],
});
const result = await composio.provider.handleToolCalls(
  'your-user-id',
  response.output
);
console.log(result);
Get tools from Tool Router session and execute urlscan.io actions with your Agent

Why Use Composio?

AI Native urlscan.io Integration

  • Supports both urlscan.io MCP and direct API based integrations
  • Structured, LLM-friendly schemas so agents can scan URLs and search results without brittle glue code
  • Rich coverage for submitting scans, retrieving reports, querying historical scan data, and working with urlscan Pro resources

Managed Auth

  • Secure API key handling for urlscan.io, so you don't have to hard-code secrets in agent code
  • Central place to manage, scope, and revoke urlscan.io access across users and environments
  • Use auth_configs.create() and connected_accounts.link() when configuring your own urlscan.io API key connection

Agent Optimized Design

  • Tools are tuned for AI agents, making tasks like “scan this suspicious URL” or “search for this phishing domain” simple and reliable
  • Comprehensive execution logs show what ran, when it ran, and on whose behalf
  • Use mcp.create() when you want to expose urlscan.io tools through an MCP server for agent frameworks

Enterprise Grade Security

  • Fine-grained RBAC so you control which agents and users can access urlscan.io
  • Scoped, least privilege access for URL scanning, search, and investigation workflows
  • Full audit trail of agent actions to support security review, incident response, and compliance
FAQ

Frequently asked questions

Yes, urlscan.io requires you to configure your own API key. Once set up, Composio handles secure credential storage and API request handling for you.

Yes! Composio's Tool Router enables agents to use multiple toolkits. Learn more.

Composio is SOC 2 and ISO 27001 compliant with all data encrypted in transit and at rest. Learn more.

Composio maintains and updates all toolkit integrations automatically, so your agents always work with the latest API versions.

Start with urlscan.io.It takes 30 seconds.

Managed auth, hosted MCP servers, and every urlscan.io tool your agent needs.Free to start.

Start building