Documentation

How VibeScan's scans, API, and MCP server work — and what exactly gets checked when you run one.

Getting started

Every scan target needs to be authorized before VibeScan touches it — there's no way around this step, by design. See the authorization model for the full detail.

Website scan — verify domain ownership with a DNS TXT record, then sign the authorization form for the specific checks you want to allow.
Repo scan — connect a GitHub repository via OAuth, then sign the authorization form the same way.
Trigger scans from the dashboard, the REST API, or an MCP-connected agent — same authorization, same findings, different entry point.

Website scan checks

HDR	Security headers	CORS policy, response header hygiene, server/version fingerprinting.
TLS	TLS/SSL config	Certificate validity, protocol/cipher strength.
CVE	Dependency/CVE checks	Known-vulnerable versions detectable from public responses.
SEC	Exposed secrets/paths	Publicly reachable .env/config files, admin panels, GraphQL introspection.
CKY	Cookie security flags	Missing Secure/HttpOnly/SameSite attributes.

Repo scan checks

SAST	Static code analysis	Injection, unsafe eval, SSRF, path traversal, missing auth checks.
PY	Python-specific scan	Python-ecosystem security patterns beyond the general SAST pass.
CVE	Dependency vulnerability scan	Known-vulnerable package versions across your lockfile.
SEC	Secret detection	Credentials in files and git history — redacted, never stored as plaintext.
CFG	Infrastructure & config audit	Dockerfiles, Kubernetes manifests, Terraform.

REST API

Authenticate with Authorization: Bearer <api-key> against /api/v1. Generate a key from Dashboard → API Keys.

Targets

GET /api/v1/domains	Your verified domains.
POST /api/v1/domains	Claim a domain. Body: { domain }. Returns the TXT record to add to DNS.
POST /api/v1/domains/:id/verify	Re-check the DNS TXT record for a claimed domain.
PATCH /api/v1/domains/:id/auto-scan	Turn scheduled scanning on or off. Body: { enabled }.
DELETE /api/v1/domains/:id	Remove a domain and every scan recorded against it.
GET /api/v1/repos	Your connected repositories.
POST /api/v1/repos	Connect a repository. Body: { url }.
DELETE /api/v1/repos/:id	Disconnect a repository and remove its scans. Nothing in the repository itself changes.

Scans and reports

GET /api/v1/scans	Your scan history.
GET /api/v1/scans/:id	A single scan with its findings.
POST /api/v1/scans	Trigger a scan. Body: exactly one of domainId, repoId or pentestTargetId, plus an optional tools array.
GET /api/v1/scans/:id/report	Download the report. ?format=json\|csv\|md\|pdf — availability depends on your plan.
POST /api/v1/scans/:id/findings/:findingId/fix	Generate a fix for one finding and open it as a pull request on a new branch.

Alerts

GET /api/v1/alerts	Your alert destinations.
POST /api/v1/alerts	Add a destination. Body: { kind: email\|slack\|discord, target, label? }.
PATCH /api/v1/alerts/:id	Pause or resume a destination. Body: { enabled }.
DELETE /api/v1/alerts/:id	Remove a destination.
POST /api/v1/alerts/:id/test	Send a clearly-labelled sample notification.

Insights

GET /api/v1/trend

Security posture over time for one asset. ?domainId= or ?repoId=. Lower scores are better.

Every domain and repo referenced by domainId/repoIdmust already have a signed authorization on file — the API can't bypass that step, only the dashboard's authorization form can create one.

MCP server

Connect VibeScan to Claude Code, Claude Desktop, Cursor, or any MCP-compatible agent so it can check your targets and kick off a scan mid-session, using the same API keys as the REST API above.

{
  "mcpServers": {
    "vibescan": {
      "type": "http",
      "url": "https://www.usevibescan.com/api/mcp",
      "headers": {
        "Authorization": "Bearer <your-api-key>"
      }
    }
  }
}

Using claude.ai directly? Add the same URL as a Custom Connector under Settings → Connectors — you'll sign in with your VibeScan account through Clerk, no API key required for that path.

You don't type tool names — your agent picks. Ask in plain English. These five cover almost everything:

Scan	“Scan usevibescan.com.”	trigger_scan
Fix	“Open a PR fixing the critical finding.”	fix_finding
Report	“Send me the full report as markdown.”	get_scan_report
Alert	“Ping my Slack channel when a scan finishes.”	add_alert
Trend	“Is my site getting more secure or less?”	get_posture_trend

All 22 tools, and something you could say to reach each one. Names are verb_nounthroughout, so they're guessable — but you shouldn't have to guess.

Scanning

“Scan usevibescan.com.”	trigger_scan
“Show my recent scans.”	list_scans
“What did that scan find?”	get_scan
“Send me the full report as markdown.”	get_scan_report
“Is my site getting more secure or less?”	get_posture_trend
“Stop that pentest scan.”	stop_scan
“Delete that scan.”	remove_scanDestructive

Fixing

“Open a PR fixing the critical finding.”

fix_finding

Websites

“Add example.com.”	add_domain
“What domains do I have?”	list_domains
“Is my DNS record live yet?”	verify_domain
“Scan example.com automatically every day.”	set_auto_scan
“Remove example.com.”	remove_domainDestructive

Repositories

“Connect github.com/me/my-app.”	add_repo
“Which repos are connected?”	list_repos
“Disconnect that repo.”	remove_repoDestructive

Alerts

“Ping my Slack channel when a scan finishes.”	add_alert
“Where do my alerts go?”	list_alerts
“Send a test alert.”	test_alert
“Pause my email alerts for now.”	set_alert_enabled
“Delete that alert destination.”	remove_alertDestructive

Pentest (gated)

“List my pentest targets.”

list_pentest_targets

Full setup walkthrough (with your own endpoint URL filled in) lives at Dashboard → MCP Server.

What the API deliberately can't do

A few things have no API or MCP equivalent on purpose. They are listed here rather than left to be discovered by being refused.

Signing an authorization to scan

Every domain and repository needs a one-time signed authorization confirming you have legal authority over the target. That attestation has to be made by a person, so it lives only in the dashboard — the API and MCP server cannot create one, and a scan without it is refused on every surface.

Creating API keys

A key that can mint further keys is an escalation waiting to happen. Keys are created in the dashboard only.

Deleting your account or full scan history

Irreversible and account-wide, so it stays a deliberate action in Settings rather than something one call away.

Plans & limits

Plan	Price	Daily scans	Auto-scans
Free	$0/mo	2/day	Not included
Pro	$9.99/mo	Unlimited	Daily, per verified domain
Max	$19.99/mo	Unlimited	Daily, per verified domain

Free plan: 2 website scans and 1 MCP-triggered scan per day; the REST API is a paid feature. Pro and Max have no daily scan limit.

Authorization & data handling

We only scan what's been explicitly, signed-off authorized — domain ownership or repo OAuth access, plus a per-target consent record before any check runs. Secret values are never stored, and repository clones are deleted immediately after each scan.

Read the full authorization model

Support

Questions not covered here? Email support@usevibescan.com or see Support & Legal in the dashboard.