Urlscan Io

What Urlscan Io does

Urlscan Io exposes urlscan.io's URL-scanning API to MCP clients. urlscan.io renders submitted pages in a sandbox and records observations such as HTTP transactions, screenshots, and certificates. The integration supports searching existing scans, retrieving a scan by UUID, submitting URLs for scanning, and narrowing searches by domain or IP address.

This is an independent Pipeworx integration rather than an official urlscan.io product. The underlying data source is https://urlscan.io/api/v1/.

How it works

A hosted MCP connection uses the Pipeworx endpoint at https://gateway.pipeworx.io/urlscan-io/mcp. The same gateway can also be accessed through its general endpoint, where the urlscan.io tools are available through routing. Pack-specific hosted connections include shared Pipeworx meta-tools such as ask_pipeworx, discover_tools, search_within, and memory tools; the exact scope is reported during MCP initialization.

For clients that use local processes, the @pipeworx/mcp-urlscan-io npm package provides a stdio bridge. It forwards calls to the hosted gateway and therefore requires network access. Direct HTTP callers can invoke tools through endpoints such as https://gateway.pipeworx.io/v1/tools/urlscan_io_search.

Setup and configuration

Add the hosted endpoint to an MCP client with a server entry like:

{
  "mcpServers": {
    "urlscan-io": {
      "url": "https://gateway.pipeworx.io/urlscan-io/mcp"
    }
  }
}

Alternatively, run the local bridge with npx:

{
  "mcpServers": {
    "urlscan-io": {
      "command": "npx",
      "args": ["-y", "@pipeworx/mcp-urlscan-io"]
    }
  }
}

Anonymous npm-bridge use is limited to 50 calls per day. A free Pipeworx account raises the limit to 200 calls per day; provide its key as PIPEWORX_API_KEY in the MCP server environment. Set PIPEWORX_META_TOOLS=1 if the local bridge should also list the shared gateway tools. Hosted and direct API authentication can use the platform key, while a ?_apiKey=... parameter is supported for bring-your-own-key access. URL submission requires a urlscan.io key; search and result lookup are keyless.

Tools and capabilities

• search(query, size?, search_after?) searches previous urlscan.io scans.
• result(uuid) retrieves the full result for a scan UUID.
• submit(url, visibility?, country?, tags?, referer?, customagent?, useragent?) starts a new scan and accepts scan metadata and request-agent options.
• domain(domain) provides a convenience search for a domain.
• ip(ip) provides a convenience search for an IP address.
• ask_pipeworx can route plain-language questions across the broader Pipeworx catalog when using a gateway connection.

Limitations and notes

The local package is a network bridge and has no offline mode. Hosted pack endpoints list the pack's tools alongside shared Pipeworx meta-tools, so the visible tool count is larger than the five urlscan-specific tools. Calls made with a Pipeworx key are sent as Bearer-authenticated requests and are metered according to the gateway account. Behind an HTTPS proxy, Node's built-in fetch does not read HTTPS_PROXY by default; newer Node versions can use it when NODE_USE_ENV_PROXY=1 is set.

The project is licensed under MIT.