# urlscan.io

```json
{
  "name": "urlscan.io",
  "slug": "urlscanio",
  "url": "https://composio.dev/toolkits/urlscanio",
  "markdown_url": "https://composio.dev/toolkits/urlscanio.md",
  "logo_url": "https://logos.composio.dev/api/urlscanio",
  "categories": [
    "developer tools & devops"
  ],
  "is_composio_managed": false,
  "updated_at": "2026-08-21T05:28:46.415Z"
}
```

![urlscan.io logo](https://logos.composio.dev/api/urlscanio)

## Description

Securely connect your AI agents and chatbots (Claude, ChatGPT, Cursor, etc) with urlscan.io MCP or direct API to submit website scans, retrieve scan results, search threat data, and manage urlscan Pro resources through natural language.

## Summary

urlscan.io is a website scanning and threat intelligence platform for analyzing URLs, domains, IPs, and web behavior.
It helps security teams investigate suspicious sites, detect phishing, and search rich scan data fast.

## Categories

- developer tools & devops

## Toolkit Details

- Tools: 50

## Images

- Logo: https://logos.composio.dev/api/urlscanio

## Authentication

- **Api Key**
  - Type: `api_key`
  - Description: Api Key authentication for urlscan.io.
  - Setup:
    - Configure Api Key credentials for urlscan.io.
    - Use the credentials when creating an auth config in Composio.

## Suggested Prompts

- Scan suspicious URLs for malware indicators
- Search phishing domains in urlscan data
- Retrieve latest scan verdict for domain

## Supported Tools

| Tool slug | Name | Description |
|---|---|---|
| `URLSCANIO_CLOSE_INCIDENT` | Close Incident | Stop ongoing scans for an active urlscan Pro incident and transition it to the closed state. Closing does not delete the incident or its history, and the incident can later be restarted. |
| `URLSCANIO_COPY_INCIDENT` | Copy Incident | Create a separate urlscan Pro incident from an existing incident's configuration. This create operation can consume incident capacity and does not copy the source incident's stored state history; use the distinct fork operation when history must be preserved. The provider does not document whether the copied incident immediately activates ongoing scans or alerts. |
| `URLSCANIO_CREATE_CHANNEL` | Create Notification Channel | Create a Pro notification channel. This operation configures external effects: active webhook channels send requests to the supplied secret URL, and active email channels send messages to the supplied recipients. Confirm the destination and activation settings before calling. |
| `URLSCANIO_CREATE_INCIDENT` | Create Incident | Create a Pro incident that persistently monitors an observable. This high-impact operation starts ongoing external scans and can send alerts through every supplied notification channel; confirm the observable, visibility, channels, cadence, and expiration settings before calling. The operation is contract-only because the connected build account lacks the urlscan Pro Incidents entitlement. |
| `URLSCANIO_CREATE_LIVE_SCAN_BLOCKING` | Run Blocking Live Scan | Run a temporary Live Scan synchronously and return only after the provider finishes the scan. This requires the separate Live Scanning product. |
| `URLSCANIO_CREATE_LIVE_SCAN_TASK` | Create Live Scan Task | Start a non-blocking temporary Live Scan on a selected scanner and return its UUID immediately without waiting for completion. This external scan side effect requires the separate urlscan.io Live Scanning entitlement; a generic Pro plan may not include it. |
| `URLSCANIO_CREATE_SAVED_SEARCH` | Create Saved Search | Create a reusable scans or hostnames search definition. This operation creates a persistent saved search and requires urlscan Pro; the hostnames datasource may require an additional product entitlement. |
| `URLSCANIO_CREATE_SUBSCRIPTION` | Create Alert Subscription | Create a persistent scheduled or live alert subscription for saved searches. This Pro-only operation has external notification side effects: an active subscription can send email, invoke configured channels or webhooks, and create incidents. Confirm all recipients and channel or incident settings before calling. |
| `URLSCANIO_DELETE_RESULT` | Delete Scan Result | Permanently delete a scan owned by the connected user or team. This destructive operation cannot be reversed and requires urlscan Pro. |
| `URLSCANIO_DELETE_SAVED_SEARCH` | Delete Saved Search | Permanently delete a saved search by ID. This destructive operation cannot be undone and requires urlscan Pro saved-search access plus ownership or team write permission. Use it only for a saved search created or explicitly selected by the current workflow. |
| `URLSCANIO_DELETE_SUBSCRIPTION` | Delete Alert Subscription | Permanently delete an alert subscription by ID. This destructive operation cannot be undone and requires urlscan Pro subscriptions access plus ownership or team write permission. Use it only for a subscription created or explicitly selected by the current workflow. |
| `URLSCANIO_DOWNLOAD_FILE` | Download Captured File | Retrieve a captured binary file by its SHA-256 hash as a password-encrypted ZIP archive. This operation requires urlscan Pro access. |
| `URLSCANIO_FORK_INCIDENT` | Fork Incident | Create a new Pro incident by copying an existing incident's configuration and complete stored state history. This creates a separate persistent incident; history volume and whether monitoring starts immediately are not documented. |
| `URLSCANIO_GET_ACCOUNT_CAPABILITIES` | Get Account Capabilities | Get non-sensitive plan, product, feature, visibility, submission, and limit information for the connected urlscan.io API key. |
| `URLSCANIO_GET_BRAND_SUMMARY` | Get Brand Summary | Return detectable brands with detected-page totals and latest hits. This operation requires urlscan Pro access and uses the official contract only; the provider does not document its response fields. |
| `URLSCANIO_GET_CHANNEL` | Get Notification Channel | Get one urlscan Pro notification channel by ID while preserving provider-specific metadata and removing webhook destinations or credentials. |
| `URLSCANIO_GET_DATA_DUMP_LINK` | Get Data Dump Download Link | Generate a temporary download URL for a path returned by LIST_DATA_DUMPS. Data Dumps require an Enterprise or Ultimate urlscan.io plan. |
| `URLSCANIO_GET_DOM` | Get Scan DOM | Return the plain-text DOM snapshot captured for a completed scan. |
| `URLSCANIO_GET_HOSTNAME_HISTORY` | Get Hostname History | Return one page of historical Pro Hostnames observations for a hostname. |
| `URLSCANIO_GET_INCIDENT` | Get Incident | Get one incident's configuration, source, runtime state, and timestamps. |
| `URLSCANIO_GET_INCIDENT_STATES` | Get Incident States | Retrieve the stored state history for an incident. |
| `URLSCANIO_GET_LIVE_SCAN_RESOURCE` | Get Live Scan Resource | Retrieve one temporary result, DOM, screenshot, captured response, or download from the separate urlscan.io Live Scanning product. JSON and text are returned inline; binary content is offloaded as a downloadable file. |
| `URLSCANIO_GET_QUOTAS` | Get API Quotas | Get current products, features, query capabilities, and per-action minute, hour, and day quota usage. |
| `URLSCANIO_GET_RESPONSE_CONTENT` | Get Captured Response Content | Return textual content captured in a scan response, addressed by its SHA-256 hash. |
| `URLSCANIO_GET_RESULT` | Get Scan Result | Retrieve the complete metadata and captured request data for a completed scan UUID. |
| `URLSCANIO_GET_SAVED_SEARCH_RESULTS` | Get Saved Search Results | Run a urlscan Pro saved search and return its current Search API results. The provider redirect is followed automatically; this operation does not expose pagination controls. |
| `URLSCANIO_GET_SCREENSHOT` | Get Scan Screenshot | Retrieve a completed urlscan.io scan screenshot as a downloadable PNG file reference. |
| `URLSCANIO_GET_SIMILAR_RESULTS` | Get Similar Scan Results | Find one page of scan results structurally similar to a specified scan. Requires urlscan Pro access. |
| `URLSCANIO_GET_SUBSCRIPTION_RESULTS` | Get Subscription Results | Resolve a urlscan Pro alert subscription and datasource to its current Search API results. The provider redirect is followed automatically; this operation does not expose pagination controls. |
| `URLSCANIO_LIST_AVAILABLE_BRANDS` | Get Available Brands | List brand identifiers and metadata tracked by urlscan.io brand and phishing detection. Requires urlscan Pro brand/phishing access; the exact product and minimum plan are not documented. |
| `URLSCANIO_LIST_AVAILABLE_COUNTRIES` | Get Available Scan Countries | List scanner country codes currently accepted by the Scan API. |
| `URLSCANIO_LIST_CHANNELS` | List Notification Channels | List email and webhook notification channels for the current user without returning webhook URLs or embedded credentials. This operation requires urlscan Pro channels access. |
| `URLSCANIO_LIST_DATA_DUMPS` | List Data Dumps | List available urlscan.io data-dump files for a time window, file type, and date. Requires an Enterprise or Ultimate plan; availability can vary by window and file type. |
| `URLSCANIO_LIST_LIVE_SCANNERS` | List Live Scanners | List Live Scanning nodes available to the connected account and their current metadata. This requires the separate urlscan.io Live Scanning product; a generic urlscan Pro plan may not include it. |
| `URLSCANIO_LIST_SAVED_SEARCHES` | List Saved Searches | List saved searches owned by or shared with the current user. This operation requires urlscan Pro saved-search access. |
| `URLSCANIO_LIST_SUBSCRIPTIONS` | List Alert Subscriptions | List alert subscriptions configured for the current user. This operation requires urlscan Pro subscriptions access. |
| `URLSCANIO_LIST_USER_AGENTS` | Get Scan User Agents | List grouped browser user-agent strings available for scan submission. |
| `URLSCANIO_LIST_WATCHABLE_ATTRIBUTES` | Get Watchable Incident Attributes | List attribute values accepted when configuring incident change monitoring. Requires urlscan Pro Incidents capability; the exact minimum plan or product is not documented. |
| `URLSCANIO_LOOKUP_MALICIOUS_OBSERVABLE` | Lookup Malicious Observable | Look up malicious-scan occurrence counts and first/last seen timestamps for an IP, hostname, domain, or exact URL. Requires urlscan Pro malicious-observable access. |
| `URLSCANIO_PURGE_LIVE_SCAN_RESULT` | Purge Live Scan Result | Permanently delete a temporary result from the separate urlscan.io Live Scanning product before its normal expiration. This destructive operation cannot be undone; only use it to clean up a temporary result created by the current workflow. |
| `URLSCANIO_RESET_RESULT_VISIBILITY` | Reset Scan Visibility | Remove an owned scan's visibility override and restore the visibility originally assigned at submission. This resets an override; it does not delete the scan. Requires urlscan Pro. |
| `URLSCANIO_RESTART_INCIDENT` | Restart Incident | Restart a closed urlscan Pro incident and extend its expiry. This resumes ongoing external monitoring, begins recording new incident states, and can resume alerts through the incident's configured notification channels; confirm the incident should become active again before calling. This operation is contract-only because the connected build account lacks Pro Incidents access. |
| `URLSCANIO_SEARCH_SCANS` | Search Scans | Search urlscan.io data with Elasticsearch Query String syntax and return one controllable page of results. |
| `URLSCANIO_STORE_LIVE_SCAN_RESULT` | Store Live Scan Result | Permanently store an existing temporary Live Scan result with the selected visibility. This updates the temporary result into a durable snapshot and requires the separate urlscan.io Live Scanning entitlement; a generic urlscan Pro plan may not include it. |
| `URLSCANIO_SUBMIT_SCAN` | Submit Scan | Submit a URL for asynchronous external scanning, creating persistent result state and consuming quota. Visibility defaults to public, and free accounts have no cleanup operation. Returns the scan UUID for result and asset retrieval. |
| `URLSCANIO_UPDATE_CHANNEL` | Update Notification Channel | Replace the complete configuration of an existing Pro notification channel. This operation can redirect external effects: active webhook channels send requests to the supplied secret URL, and active email channels send messages to the supplied recipients. Confirm the complete destination and activation settings before calling. |
| `URLSCANIO_UPDATE_INCIDENT` | Update Incident | Replace an existing incident's monitoring configuration and runtime options. This Pro-only PUT requires observable, visibility, and the complete channel set, not only changed values. Updating it changes ongoing external scanning and can redirect or trigger future channel alerts; confirm the complete replacement configuration before calling. |
| `URLSCANIO_UPDATE_RESULT_VISIBILITY` | Update Scan Visibility | Change the visibility of a scan owned by the connected user or team. This operation requires a paid urlscan Pro entitlement and is contract-only, not live verified. Use DELETE_RESULT for permanent deletion. |
| `URLSCANIO_UPDATE_SAVED_SEARCH` | Update Saved Search | Replace the complete definition and metadata of an existing saved search. This PUT operation requires urlscan Pro saved-search access and write permission; the hostnames datasource may require an additional entitlement. |
| `URLSCANIO_UPDATE_SUBSCRIPTION` | Update Alert Subscription | Replace the complete configuration of an existing alert subscription. This Pro-only PUT requires every mandatory field, not only changed values. It has external notification side effects: activating the subscription or changing recipients, channels, webhooks, or incident settings can send notifications or create incidents. Confirm the complete replacement configuration before calling. |

## Supported Triggers

None listed.

## Installation and MCP Setup

### Path 1: SDK Installation

#### Path 1, Step 1: Install Composio

Install the Composio SDK
```python
pip install composio_openai
```

```typescript
npm install @composio/openai
```

#### Path 1, Step 2: Initialize Composio and Create Tool Router Session

Import and initialize Composio client, then create a Tool Router session
```python
from openai import OpenAI
from composio import Composio
from composio_openai import OpenAIResponsesProvider

composio = Composio(provider=OpenAIResponsesProvider())
openai = OpenAI()
session = composio.create(user_id='your-user-id')
```

```typescript
import OpenAI from 'openai';
import { Composio } from '@composio/core';
import { OpenAIResponsesProvider } from '@composio/openai';

const composio = new Composio({
  provider: new OpenAIResponsesProvider(),
});
const openai = new OpenAI({});
const session = await composio.create('your-user-id');
```

#### Path 1, Step 3: Execute urlscan.io Tools via Tool Router with Your Agent

Get tools from Tool Router session and execute urlscan.io actions with your Agent
```python
tools = session.tools
response = openai.responses.create(
  model='gpt-4.1',
  tools=tools,
  input=[{
    'role': 'user',
    'content': 'Search urlscan.io for scans matching domain:example.com and summarize the latest results'
  }]
)
result = composio.provider.handle_tool_calls(
  response=response,
  user_id='your-user-id'
)
print(result)
```

```typescript
const tools = session.tools;
const response = await openai.responses.create({
  model: 'gpt-4.1',
  tools: tools,
  input: [{
    role: 'user',
    content: 'Search urlscan.io for scans matching domain:example.com and summarize the latest results'
  }],
});
const result = await composio.provider.handleToolCalls(
  'your-user-id',
  response.output
);
console.log(result);
```

### Path 2: MCP Server Setup

#### Path 2, Step 1: Install Composio

Install the Composio SDK for Python or TypeScript
```python
pip install composio claude-agent-sdk
```

```typescript
npm install @composio/core ai @ai-sdk/openai @ai-sdk/mcp
```

#### Path 2, Step 2: Initialize Client and Create Tool Router Session

Import and initialize the Composio client, then create a Tool Router session for urlscan.io
```python
from composio import Composio
from claude_agent_sdk import ClaudeSDKClient, ClaudeAgentOptions

composio = Composio(api_key='your-composio-api-key')
session = composio.create(user_id='your-user-id')
url = session.mcp.url
```

```typescript
import { Composio } from '@composio/core';

const composio = new Composio({ apiKey: 'your-api-key' });
const session = await composio.create('your-user-id');
console.log(`Tool Router session created: ${session.mcp.url}`);
```

#### Path 2, Step 3: Connect to AI Agent

Use the MCP server with your AI agent (Anthropic Claude or Mastra)
```python
import asyncio

options = ClaudeAgentOptions(
    permission_mode='bypassPermissions',
    mcp_servers={
        'tool_router': {
            'type': 'http',
            'url': url,
            'headers': {
                'x-api-key': 'your-composio-api-key'
            }
        }
    },
    system_prompt='You are a helpful assistant with access to urlscan.io tools.',
    max_turns=10
)

async def main():
    async with ClaudeSDKClient(options=options) as client:
        await client.query('Submit https://example.com to urlscan.io and summarize the scan results')
        async for message in client.receive_response():
            if hasattr(message, 'content'):
                for block in message.content:
                    if hasattr(block, 'text'):
                        print(block.text)

asyncio.run(main())
```

```typescript
import { openai } from '@ai-sdk/openai';
import { experimental_createMCPClient as createMCPClient } from '@ai-sdk/mcp';
import { generateText } from 'ai';

const client = await createMCPClient({
  transport: {
    type: 'http',
    url: session.mcp.url,
    headers: {
      'x-api-key': 'your-composio-api-key',
    },
  },
});

const tools = await client.tools();
const { text } = await generateText({
  model: openai('gpt-4o'),
  tools,
  messages: [{
    role: 'user',
    content: 'Submit https://example.com to urlscan.io and summarize the scan results'
  }],
  maxSteps: 5,
});

console.log(`Agent: ${text}`);
```

## Why Use Composio?

### 1. AI Native urlscan.io Integration

- Supports both urlscan.io MCP and direct API based integrations
- Structured, LLM-friendly schemas so agents can scan URLs and search results without brittle glue code
- Rich coverage for submitting scans, retrieving reports, querying historical scan data, and working with urlscan Pro resources

### 2. Managed Auth

- Secure API key handling for urlscan.io, so you don't have to hard-code secrets in agent code
- Central place to manage, scope, and revoke urlscan.io access across users and environments
- Use auth_configs.create() and connected_accounts.link() when configuring your own urlscan.io API key connection

### 3. Agent Optimized Design

- Tools are tuned for AI agents, making tasks like “scan this suspicious URL” or “search for this phishing domain” simple and reliable
- Comprehensive execution logs show what ran, when it ran, and on whose behalf
- Use mcp.create() when you want to expose urlscan.io tools through an MCP server for agent frameworks

### 4. Enterprise Grade Security

- Fine-grained RBAC so you control which agents and users can access urlscan.io
- Scoped, least privilege access for URL scanning, search, and investigation workflows
- Full audit trail of agent actions to support security review, incident response, and compliance

## Use urlscan.io with any AI Agent Framework

Choose a framework you want to connect urlscan.io with:

None listed.

## Related Toolkits

- [Supabase](https://composio.dev/toolkits/supabase) - Supabase is an open-source backend platform offering scalable Postgres databases, authentication, storage, and real-time APIs. It lets developers build modern apps without managing infrastructure.
- [Codeinterpreter](https://composio.dev/toolkits/codeinterpreter) - Codeinterpreter is a Python-based coding environment with built-in data analysis and visualization. It lets you instantly run scripts, plot results, and prototype solutions inside supported platforms.
- [GitHub](https://composio.dev/toolkits/github) - GitHub is a code hosting platform for version control and collaborative software development. It streamlines project management, code review, and team workflows in one place.
- [1password](https://composio.dev/toolkits/_1password) - 1Password is a password manager and digital vault for storing logins, secrets, notes, and secure documents. It helps individuals and teams protect credentials, share access safely, and reduce password risk.
- [Ably](https://composio.dev/toolkits/ably) - Ably is a real-time messaging platform for live chat and data sync in modern apps. It offers global scale and rock-solid reliability for seamless, instant experiences.
- [Abuselpdb](https://composio.dev/toolkits/abuselpdb) - Abuselpdb is a central database for reporting and checking IPs linked to malicious online activity. Use it to quickly identify and report suspicious or abusive IP addresses.
- [Alchemy](https://composio.dev/toolkits/alchemy) - Alchemy is a blockchain development platform offering APIs and tools for Ethereum apps. It simplifies building and scaling Web3 projects with robust infrastructure.
- [Algolia](https://composio.dev/toolkits/algolia) - Algolia is a hosted search API that powers lightning-fast, relevant search experiences for web and mobile apps. It helps developers deliver instant, typo-tolerant, and scalable search without complex infrastructure.
- [Anchor browser](https://composio.dev/toolkits/anchor_browser) - Anchor browser is a developer platform for AI-powered web automation. It transforms complex browser actions into easy API endpoints for streamlined web interaction.
- [Apiflash](https://composio.dev/toolkits/apiflash) - Apiflash is a website screenshot API for programmatically capturing web pages. It delivers high-quality screenshots on demand for automation, monitoring, or reporting.
- [Apiverve](https://composio.dev/toolkits/apiverve) - Apiverve delivers a suite of powerful APIs that simplify integration for developers. It's designed for reliability and scalability so you can build faster, smarter applications without the integration headache.
- [Appcircle](https://composio.dev/toolkits/appcircle) - Appcircle is an enterprise-grade mobile CI/CD platform for building, testing, and publishing mobile apps. It streamlines mobile DevOps so teams ship faster and with more confidence.
- [Appdrag](https://composio.dev/toolkits/appdrag) - Appdrag is a cloud platform for building websites, APIs, and databases with drag-and-drop tools and code editing. It accelerates development and iteration by combining hosting, database management, and low-code features in one place.
- [Appveyor](https://composio.dev/toolkits/appveyor) - AppVeyor is a cloud-based continuous integration service for building, testing, and deploying applications. It helps developers automate and streamline their software delivery pipelines.
- [AWS Marketplace MCP](https://composio.dev/toolkits/aws_marketplace_mcp) - AWS Marketplace MCP provides MCP access to AWS Marketplace's cloud software, data, and services catalog. Use it to discover, compare, and evaluate 30K+ AWS Marketplace listings faster.
- [Backendless](https://composio.dev/toolkits/backendless) - Backendless is a backend-as-a-service platform for mobile and web apps, offering database, file storage, user authentication, and APIs. It helps developers ship scalable applications faster without managing server infrastructure.
- [Baserow](https://composio.dev/toolkits/baserow) - Baserow is an open-source no-code database platform for building collaborative data apps. It makes it easy for teams to organize data and automate workflows without writing code.
- [Bench](https://composio.dev/toolkits/bench) - Bench is a benchmarking tool for automated performance measurement and analysis. It helps you quickly evaluate, compare, and track your systems or workflows.
- [Better stack](https://composio.dev/toolkits/better_stack) - Better Stack is a monitoring, logging, and incident management solution for apps and services. It helps teams ensure application reliability and performance with real-time insights.
- [Bitbucket](https://composio.dev/toolkits/bitbucket) - Bitbucket is a Git-based code hosting and collaboration platform for teams. It enables secure repository management and streamlined code reviews.

## Frequently Asked Questions

### Do I need my own developer credentials to use urlscan.io with Composio?

Yes, urlscan.io requires you to configure your own API key. Once set up, Composio handles secure credential storage and API request handling for you.

### Can I use multiple toolkits together?

Yes! Composio's Tool Router enables agents to use multiple toolkits. [Learn more](https://docs.composio.dev/tool-router/overview).

### Is Composio secure?

Composio is SOC 2 and ISO 27001 compliant with all data encrypted in transit and at rest. [Learn more](https://trust.composio.dev).

### What if the API changes?

Composio maintains and updates all toolkit integrations automatically, so your agents always work with the latest API versions.

---
[See all toolkits](https://composio.dev/toolkits) · [Composio docs](https://docs.composio.dev/llms.txt)