Scan.now Security Tools

Use Scan.now when the user wants a passive security assessment of a website they are authorized to test, or wants to inspect a suspicious public link for phishing signals.

Scan.now tools

Connect to the public Streamable HTTP MCP endpoint at https://mcp.scan.now. No API key, account, or environment variable is required. Do not ask the user to obtain a Scan.now credential, and do not invent REST endpoints; use the MCP tools exposed by that server.

Use scan_website_security only after the user states that they own the target website or have explicit permission to assess it. If that authorization is absent, ask for it before calling the tool. Set authorized to true only after that confirmation.

Call it with:

• url: the public HTTP or HTTPS website to assess.
• authorized: true only after the user's confirmation.
• scope: optional; one of full, tls, headers, email, or js.

Choose the narrowest useful scope:

• full for a broad passive assessment.
• tls for certificates, protocol support, and HTTPS behavior.
• headers for HTTP security headers, cookies, CORS, and related page controls.
• email for SPF, DKIM, DMARC, DNSSEC, CAA, and email-domain posture.
• js for public JavaScript inventory and known vulnerable library versions.

Use check_phishing_link when the user wants to understand whether a public link looks deceptive or where it redirects. Explain that a low score is not a guarantee: a new or unreported phishing page may not yet appear on blocklists.

Call it with url and, optionally, follow_redirects (default true). This tool does not require the website-ownership confirmation because it inspects a link rather than assessing a user's website.

These tools are passive and read-only. They do not exploit findings, bypass access controls, guess credentials, scan private networks, or prove that a target is secure. Do not help use the results for unauthorized access. Prefer the finding's reference_url when the user asks how to fix an issue.

Use https://scan.now/methodology when the user asks how the checks work and https://mcp.scan.now/privacy-policy for MCP-specific data handling.