Security & Testing

onscanner.com

This server provides an interface for managing and running security scans on saved targets.

1 endpoint8 known toolsFirst detected June 29, 2026Last detected September 17, 2026

ENDPOINT 1

https://mcp.onscanner.com/mcp

No auth detected

MCP server metadata

Name: onscanner
Version: 1.13.1

Capabilities

experimentalpromptsresourcestools

Server instructions

Run OnScanner external security and privacy scans against targets the authenticated account owns or is authorized to test. Authenticate by sending your OnScanner API key in the 'ONSCANNER-KEY' header. To scan a site, pick or create a target, start a scan, then wait for it to finish (scans run asynchronously, so check its status until it reports completed) and read the results. Use deep mode for a more thorough, browser-driven crawl that surfaces more findings (it costs more credits and takes longer). To scan pages behind a login, pass one-time cookie/bearer/basic credentials with the scan, or reuse a login saved on the target in the app; authenticated scans run against a single host. Scans consume account credits and may only target assets you are authorized to scan.

Known tools 8

list_targets

List the saved targets in the authenticated OnScanner account.

Inferred read-only

create_target

Create a saved target (a domain, IP, or CIDR you are authorized to scan).

Potential side effects

get_target

Get a target's details plus a page of its scan history.

Inferred read-only

start_scan

Start a new scan.

Inferred read-only

list_scans

List scans in the account, most recent first (10 per page).

Inferred read-only

get_scan_status

Lightweight scan status.

Inferred read-only

get_scan_results

Full structured results of a scan: summary, assets, DNS, hosts, technologies (with matched CVEs), email_security (plus email_security_subdomains when subdomains were scanned), privacy_risks, and owasp_findings.

Inferred read-only

get_scan_ai_analysis

Get the AI analysis for a scan, produced when AI analysis or compliance was enabled on it (analysis types: summary, enrichment, correlation, kill-chain, compliance, diff).

Inferred read-only

CONNECT WITH APPROVAL

Client installation

Review this server and its permissions before adding it. Secret placeholders must be set locally.

Codex

~/.codex/config.toml

[mcp_servers.onscanner]
url = "https://mcp.onscanner.com/mcp"
enabled = true

Claude Code

.mcp.json

{
  "mcpServers": {
    "onscanner": {
      "type": "http",
      "url": "https://mcp.onscanner.com/mcp"
    }
  }
}

Claude Desktop

Settings → Connectors → Add custom connector

Name: onscanner
Remote MCP URL: https://mcp.onscanner.com/mcp

Add this remote URL as a custom connector in Claude Desktop. Availability depends on the user plan and workspace policy.

Cursor

.cursor/mcp.json

{
  "mcpServers": {
    "onscanner": {
      "url": "https://mcp.onscanner.com/mcp"
    }
  }
}

Visual Studio Code

.vscode/mcp.json

Add to Visual Studio Code

{
  "servers": {
    "onscanner": {
      "type": "http",
      "url": "https://mcp.onscanner.com/mcp"
    }
  }
}

Generic MCP

Client-specific MCP configuration

{
  "name": "onscanner",
  "transport": "streamable-http",
  "url": "https://mcp.onscanner.com/mcp"
}

MCP Inspector

Run the official MCP Inspector locally and enter the indexed Streamable HTTP endpoint.

TRUST AND VERIFICATION EVIDENCE

Loading Trust v2 evidence…

Checking the associated registrable domain. The BuiltWith key remains server-side.

Indexed

Evidence is source-attributed and does not guarantee that a third-party server is safe. Risk labels are conservative metadata heuristics.