Documentation

How VibeScan's scans, API, and MCP server work — and what exactly gets checked when you run one.

Getting started

Every scan target needs to be authorized before VibeScan touches it — there's no way around this step, by design. See the authorization model for the full detail.

Website scan — verify domain ownership with a DNS TXT record, then sign the authorization form for the specific checks you want to allow.
Repo scan — connect a GitHub repository via OAuth, then sign the authorization form the same way.
Trigger scans from the dashboard, the REST API, or an MCP-connected agent — same authorization, same findings, different entry point.

Website scan checks

HDR	Security headers	CORS policy, response header hygiene, server/version fingerprinting.
TLS	TLS/SSL config	Certificate validity, protocol/cipher strength.
CVE	Dependency/CVE checks	Known-vulnerable versions detectable from public responses.
SEC	Exposed secrets/paths	Publicly reachable .env/config files, admin panels, GraphQL introspection.
CKY	Cookie security flags	Missing Secure/HttpOnly/SameSite attributes.

Repo scan checks

SAST	Static code analysis	Injection, unsafe eval, SSRF, path traversal, missing auth checks.
PY	Python-specific scan	Python-ecosystem security patterns beyond the general SAST pass.
CVE	Dependency vulnerability scan	Known-vulnerable package versions across your lockfile.
SEC	Secret detection	Credentials in files and git history — redacted, never stored as plaintext.
CFG	Infrastructure & config audit	Dockerfiles, Kubernetes manifests, Terraform.

REST API

Authenticate with Authorization: Bearer <api-key> against /api/v1. Generate a key from Dashboard → API Keys.

GET /api/v1/domains	Your verified domains.
GET /api/v1/repos	Your connected repositories.
GET /api/v1/scans	Your scan history.
GET /api/v1/scans/:id	A single scan with its findings.
POST /api/v1/scans	Trigger a scan. Body: exactly one of `domainId`, `repoId`, or `pentestTargetId`, plus an optional `tools` array. Returns `{ scan }` with status 201.

Every domain/repo referenced by domainId/repoId must already have a signed authorization on file — the API can't bypass that step, only the dashboard's authorization form can create one.

MCP server

Connect VibeScan to Claude Code, Claude Desktop, Cursor, or any MCP-compatible agent so it can check your targets and kick off a scan mid-session, using the same API keys as the REST API above.

{
  "mcpServers": {
    "vibescan": {
      "type": "http",
      "url": "https://www.usevibescan.com/api/mcp",
      "headers": {
        "Authorization": "Bearer <your-api-key>"
      }
    }
  }
}

Using claude.ai directly? Add the same URL as a Custom Connector under Settings → Connectors — you'll sign in with your VibeScan account through Clerk, no API key required for that path.

list_domains / list_repos — your verified scan targets
trigger_scan — run a scan by domain or repo id
list_scans / get_scan — scan history and findings

Full setup walkthrough (with your own endpoint URL filled in) lives at Dashboard → MCP Server.

Plans & limits

Plan	Price	Daily scans	Auto-scans
Free	$0/mo	5/day	1x/week per verified domain
Pro	$9.99/mo	15/day	3x/week per verified domain
Max	$19.99/mo	30/day	7x/week per verified domain

Free plan: API- and MCP-triggered scans are capped at 5/day each, separate from the dashboard bucket. Pro/Max share one daily quota across every channel.

Authorization & data handling

We only scan what's been explicitly, signed-off authorized — domain ownership or repo OAuth access, plus a per-target consent record before any check runs. Secret values are never stored, and repository clones are deleted immediately after each scan.

Read the full authorization model

Support

Questions not covered here? Email support@usevibescan.com or see Support & Legal in the dashboard.