urlscan.io
Submit and retrieve website scans, search urlscan.io data, and manage urlscan Pro resources for threat intelligence and security investigations.
Verdict
Common use cases
- Triage phishing links from customer emails
- Investigate domains in firewall deny logs
- Monitor threat actor infrastructure daily
- Enrich SIEM alerts with scan verdicts
- Track campaign domains across incident timeline
Integration
- Vendor
- urlscan.io
- Category
- other
- Auth
- API_KEY
- Tools
- 50
- Composio slug
urlscanio
Tools
- Close Incident
Stop ongoing scans for an active urlscan Pro incident and transition it to the closed state. Closing does not delete the incident or its history, and the incident can later be restarted.
- Copy Incident
Create a separate urlscan Pro incident from an existing incident's configuration. This create operation can consume incident capacity and does not copy the source incident's stored state history; use the distinct fork operation when history
- Create Alert Subscription
Create a persistent scheduled or live alert subscription for saved searches. This Pro-only operation has external notification side effects: an active subscription can send email, invoke configured channels or webhooks, and create incidents
- Create Incident
Create a Pro incident that persistently monitors an observable. This high-impact operation starts ongoing external scans and can send alerts through every supplied notification channel; confirm the observable, visibility, channels, cadence,
- Create Live Scan Task
Start a non-blocking temporary Live Scan on a selected scanner and return its UUID immediately without waiting for completion. This external scan side effect requires the separate urlscan.io Live Scanning entitlement; a generic Pro plan may
- Create Notification Channel
Create a Pro notification channel. This operation configures external effects: active webhook channels send requests to the supplied secret URL, and active email channels send messages to the supplied recipients. Confirm the destination and
- Create Saved Search
Create a reusable scans or hostnames search definition. This operation creates a persistent saved search and requires urlscan Pro; the hostnames datasource may require an additional product entitlement.
- Delete Alert Subscriptiondestructive
Permanently delete an alert subscription by ID. This destructive operation cannot be undone and requires urlscan Pro subscriptions access plus ownership or team write permission. Use it only for a subscription created or explicitly selected
- Delete Saved Searchdestructive
Permanently delete a saved search by ID. This destructive operation cannot be undone and requires urlscan Pro saved-search access plus ownership or team write permission. Use it only for a saved search created or explicitly selected by the
- Delete Scan Resultdestructive
Permanently delete a scan owned by the connected user or team. This destructive operation cannot be reversed and requires urlscan Pro.
- Download Captured File
Retrieve a captured binary file by its SHA-256 hash as a password-encrypted ZIP archive. This operation requires urlscan Pro access.
- Fork Incident
Create a new Pro incident by copying an existing incident's configuration and complete stored state history. This creates a separate persistent incident; history volume and whether monitoring starts immediately are not documented.
- Get Account Capabilities
Get non-sensitive plan, product, feature, visibility, submission, and limit information for the connected urlscan.io API key.
- Get API Quotas
Get current products, features, query capabilities, and per-action minute, hour, and day quota usage.
- Get Available Brands
List brand identifiers and metadata tracked by urlscan.io brand and phishing detection. Requires urlscan Pro brand/phishing access; the exact product and minimum plan are not documented.
- Get Available Scan Countries
List scanner country codes currently accepted by the Scan API.
- Get Brand Summary
Return detectable brands with detected-page totals and latest hits. This operation requires urlscan Pro access and uses the official contract only; the provider does not document its response fields.
- Get Captured Response Content
Return textual content captured in a scan response, addressed by its SHA-256 hash.
- Get Data Dump Download Link
Generate a temporary download URL for a path returned by LIST_DATA_DUMPS. Data Dumps require an Enterprise or Ultimate urlscan.io plan.
- Get Deprecated Phishing Feed
Retrieve the deprecated urlscan Pro phishing feed in JSON, CSV, or TSV. Prefer SEARCH_SCANS for new workflows, as recommended by urlscan.io.
- Get Hostname History
Return one page of historical Pro Hostnames observations for a hostname.
- Get Incident
Get one incident's configuration, source, runtime state, and timestamps.
- Get Incident States
Retrieve the stored state history for an incident.
- Get Live Scan Resource
Retrieve one temporary result, DOM, screenshot, captured response, or download from the separate urlscan.io Live Scanning product. JSON and text are returned inline; binary content is offloaded as a downloadable file.
- Get Notification Channel
Get one urlscan Pro notification channel by ID while preserving provider-specific metadata and removing webhook destinations or credentials.
- Get Saved Search Results
Run a urlscan Pro saved search and return its current Search API results. The provider redirect is followed automatically; this operation does not expose pagination controls.
- Get Scan DOM
Return the plain-text DOM snapshot captured for a completed scan.
- Get Scan Result
Retrieve the complete metadata and captured request data for a completed scan UUID.
- Get Scan Screenshot
Retrieve a completed urlscan.io scan screenshot as a downloadable PNG file reference.
- Get Scan User Agents
List grouped browser user-agent strings available for scan submission.
- Get Similar Scan Results
Find one page of scan results structurally similar to a specified scan. Requires urlscan Pro access.
- Get Subscription Results
Resolve a urlscan Pro alert subscription and datasource to its current Search API results. The provider redirect is followed automatically; this operation does not expose pagination controls.
- Get Watchable Incident Attributes
List attribute values accepted when configuring incident change monitoring. Requires urlscan Pro Incidents capability; the exact minimum plan or product is not documented.
- List Alert Subscriptions
List alert subscriptions configured for the current user. This operation requires urlscan Pro subscriptions access.
- List Data Dumps
List available urlscan.io data-dump files for a time window, file type, and date. Requires an Enterprise or Ultimate plan; availability can vary by window and file type.
- List Live Scanners
List Live Scanning nodes available to the connected account and their current metadata. This requires the separate urlscan.io Live Scanning product; a generic urlscan Pro plan may not include it.
- List Notification Channels
List email and webhook notification channels for the current user without returning webhook URLs or embedded credentials. This operation requires urlscan Pro channels access.
- List Saved Searches
List saved searches owned by or shared with the current user. This operation requires urlscan Pro saved-search access.
- Lookup Malicious Observable
Look up malicious-scan occurrence counts and first/last seen timestamps for an IP, hostname, domain, or exact URL. Requires urlscan Pro malicious-observable access.
- Purge Live Scan Resultdestructive
Permanently delete a temporary result from the separate urlscan.io Live Scanning product before its normal expiration. This destructive operation cannot be undone; only use it to clean up a temporary result created by the current workflow.
- Reset Scan Visibility
Remove an owned scan's visibility override and restore the visibility originally assigned at submission. This resets an override; it does not delete the scan. Requires urlscan Pro.
- Restart Incident
Restart a closed urlscan Pro incident and extend its expiry. This resumes ongoing external monitoring, begins recording new incident states, and can resume alerts through the incident's configured notification channels; confirm the incident
- Run Blocking Live Scan
Run a temporary Live Scan synchronously and return only after the provider finishes the scan. This requires the separate Live Scanning product.
- Search Scans
Search urlscan.io data with Elasticsearch Query String syntax and return one controllable page of results.
- Store Live Scan Result
Permanently store an existing temporary Live Scan result with the selected visibility. This updates the temporary result into a durable snapshot and requires the separate urlscan.io Live Scanning entitlement; a generic urlscan Pro plan may
- Submit Scan
Submit a URL for asynchronous external scanning, creating persistent result state and consuming quota. Visibility defaults to public, and free accounts have no cleanup operation. Returns the scan UUID for result and asset retrieval.
- Update Incident
Replace an existing incident's monitoring configuration and runtime options. This Pro-only PUT requires observable, visibility, and the complete channel set, not only changed values. Updating it changes ongoing external scanning and can red
- Update Notification Channel
Replace the complete configuration of an existing Pro notification channel. This operation can redirect external effects: active webhook channels send requests to the supplied secret URL, and active email channels send messages to the suppl
- Update Saved Search
Replace the complete definition and metadata of an existing saved search. This PUT operation requires urlscan Pro saved-search access and write permission; the hostnames datasource may require an additional entitlement.
- Update Scan Visibility
Change the visibility of a scan owned by the connected user or team. This operation requires a paid urlscan Pro entitlement and is contract-only, not live verified. Use DELETE_RESULT for permanent deletion.
Setup
Setup guide
- 11. In Switchy, open Settings → Integrations and click Connect next to urlscan.io. 2. You'll see a prompt for an API key; obtain yours by logging into urlscan.io, navigating to Settings → API, and copying the key (free accounts get limited quota; Pro unlocks incidents and alerts). 3. Paste the key into Switchy and click Authorize. 4. Switchy confirms the connection and lists available tools. 5. Open any Project, type '@urlscan.io scan this URL: https://example.com' in the chat, and send; the AI invokes the scan tool and returns a result summary with verdict and screenshot link. 6. For Pro workflows, try '@urlscan.io create an incident monitoring example.com' to start persistent tracking. 7. If a tool fails with a 403 or quota error, verify your urlscan.io plan supports that feature and your key has sufficient quota remaining.
What teammates see: by default, memories from urlscan.io are scoped to the Project (PROJECT visibility) - you can mark any memory PRIVATE or share it ORG-wide.
Works well with
Top models
Compatibility data appears once enough Projects have used this MCP together with a given model.
How Switchy teams use it
Starter prompts
Scan Suspicious Link
@urlscan.io scan this URL for threats: https://example-phishing-site.com. Return the verdict, any malicious indicators, and a screenshot link.
Search Recent Scans
@urlscan.io search for all scans in the past 7 days containing the domain 'malicious-example.net'. Show me the most recent five results with their verdicts.
Create Monitoring Incident
@urlscan.io create an incident to monitor 'suspicious-domain.com' daily. Set it to alert via email if the verdict changes to malicious.
Check Incident Status
@urlscan.io get the status of incident ID 12345. Show me the last three scan results and whether any alerts fired.
Save Threat Hunt Query
@urlscan.io create a saved search for scans with ASN 12345 and verdict 'malicious' in the past 30 days. Name it 'ASN12345 Malicious Activity'.
Example outputs
Illustrative - representative of the model's voice and quality, not literal recordings.
@urlscan search for all scans of example.com in the last 7 days and summarize any suspicious findings by severity
Found 23 scans of example.com domains in the past week. High-severity findings: 2 scans flagged phishing indicators (suspicious login forms, brand impersonation). Medium-severity: 5 scans showed unexpected redirects to third-party ad networks. Low-severity: 8 scans noted outdated TLS certificates. 8 scans returned clean with no flags. Most recent suspicious scan was 2 days ago showing a fake login page at example.com/secure-login mimicking a banking interface.
This example demonstrates urlscan's search and threat-intelligence capabilities. The MCP retrieves historical scan data and the AI synthesizes findings into actionable security insights. Requires API key with search access; results depend on whether scans exist in urlscan's database for the queried domain.
@urlscan create a live scan task for https://suspicious-domain.net and tell me when it detects any phishing indicators or malicious scripts
Live scan task created with UUID a7f3c2e1-4b9d-4a2c-8f1e-9d6c5b4a3e2f. The scan is now running on urlscan's infrastructure. Initial results show the page loads a login form with brand logos matching a known financial institution, but the domain is unregistered as of 3 months ago. Detected 2 obfuscated JavaScript files attempting credential capture. Scan flagged as high-risk phishing attempt. Full report available at urlscan.io/result/a7f3c2e1.
This example shows urlscan's active scanning capability with real-time threat detection. Creates an external scan that consumes API quota and generates a public or private result page. Requires Live Scan feature access; scan duration varies by page complexity. Side effect: the target site will see a request from urlscan's scanner infrastructure.
@urlscan create an incident to monitor phishing variants of our-brand.com and set up email alerts whenever a new suspicious domain is detected
Pro incident created (ID: inc_8x4k2m9p) to monitor phishing variants of our-brand.com. Configured persistent monitoring with these parameters: daily automated scans of typosquatting domains, brand impersonation detection enabled, email notifications active for your-team@company.com. The incident will trigger alerts when new domains matching 'our-brand' with common phishing patterns are registered or scanned. Current capacity: 1 of 5 Pro incidents used. Incident is now active and scanning.
This example demonstrates urlscan Pro's persistent monitoring and alerting workflow. Creates an ongoing incident that consumes Pro capacity and generates external side effects: automated scans run continuously and email alerts fire when conditions match. Requires Pro subscription with incident capacity available. Cannot be undone without explicitly closing the incident.
Use-case deep-dives
When urlscan.io MCP beats manual link checks for SOC teams
A 3-person security team at a 50-employee SaaS company gets 20-30 suspicious link reports per week from employees. The urlscan.io MCP is the right call here because it automates the scan-and-verdict loop that otherwise burns 10 minutes per link. The Create Live Scan Task tool starts a non-blocking scan, and the team can batch-check results in Switchy without switching to the urlscan dashboard. The threshold: if you're already paying for urlscan Pro and your team triages more than 5 links per day, this MCP pays for itself in saved context-switching. If you're on the free tier or only check 1-2 links per week, the API key setup overhead isn't worth it. For teams running incident response at scale, the Create Incident tool turns one-off scans into persistent monitoring, but that's overkill for basic phishing triage.
How this MCP handles ongoing domain impersonation tracking
A 2-person marketing ops team at a fintech startup needs to catch lookalike domains targeting their customers. The urlscan.io MCP works well here because the Create Saved Search and Create Alert Subscription tools let them define a search once ("domains containing our brand name") and get notified when new matches appear. The Create Notification Channel tool routes alerts to Slack without manual polling. The trade-off: this workflow requires urlscan Pro, and the MCP's 50-tool surface is heavy if all you need is "scan this URL once." If your brand monitoring is ad-hoc (checking a suspicious domain every few weeks), the free tier plus manual searches is simpler. If you're tracking 10+ lookalike patterns and need weekly reports, the MCP's alert automation justifies the Pro subscription and the API key setup cost.
When this MCP fits analyst deep-dive investigations
A solo threat researcher at a cybersecurity consultancy investigates malware campaigns by tracing C2 infrastructure. The urlscan.io MCP is borderline here. The Create Live Scan Task tool is useful for quickly scanning a batch of 20 domains without leaving Switchy, and the saved search tools help track patterns across campaigns. But the MCP's incident-management tools (Close Incident, Copy Incident) are designed for ongoing monitoring, not one-time research sprints. If your workflow is "scan 50 domains, export results, move on," the urlscan web UI is faster than configuring API auth. The MCP wins if you're running multi-week investigations where you revisit the same observables and need to automate rescan schedules. For researchers who bill hourly and need audit trails, the MCP's structured tool calls beat manual dashboard clicks.
Frequently asked
What does the urlscan.io MCP do in Switchy?
It lets your team submit URLs for security scanning, create persistent monitoring incidents, and manage alert subscriptions directly from Switchy's chat interface. You can start scans, check results, and configure notification channels without switching to the urlscan.io dashboard. Most advanced features require a urlscan Pro account.
Do I need a urlscan Pro account to use this MCP?
Basic URL scanning works with a free API key, but most tools in this MCP require urlscan Pro. Creating incidents, setting up alert subscriptions, managing notification channels, and accessing saved searches all need Pro. Check your urlscan.io plan before connecting if you want more than one-off scans.
Can this MCP automatically scan URLs my team shares in chat?
No. The MCP submits scans on demand when you explicitly ask Switchy to scan a URL. It won't monitor your chat for links or trigger scans automatically. If you want continuous monitoring, create an incident through the MCP and configure urlscan.io's own alert channels to notify your team.
Why use this instead of the urlscan.io web interface?
Speed and context. You can scan a suspicious link, check an incident status, or create an alert subscription without leaving the conversation where the threat was discussed. The MCP is faster for ad-hoc scans during incident response, but the web UI is still better for reviewing detailed scan visualisations and historical data.
Who on the team should connect the urlscan.io API key?
Whoever owns your urlscan.io account or has admin access to generate API keys. The key grants full access to your urlscan.io data and can create incidents that consume your Pro capacity. One shared connection per workspace is usually enough—everyone can use it through Switchy without needing their own key.