For AI website security, the strongest matches are products that actively scan a website's own security posture: ScanLabsAI runs OWASP Top 10, CVE, SSL and security-header scans on any URL 2, ContrastAPI runs a full-site scan covering HTTP security headers, SSL/TLS, DNS and redirect chains 111, and middleBrick scores API endpoints for OWASP and other exposures 3. Use these for the website itself, and use code-level scanners such as Semgrep 4 if you also need to check source code.
- 1
ContrastAPIcontrastcyber.comverified and signed
Runs an active website security scan through its ContrastScan engine, covering HTTP security headers, SSL/TLS, DNS, redirect chains and information disclosure 11, and is offered as a free MCP server with no API key 1.
official:MCP server · ContrastAPI
for agents: contrast_scan · Contrast Scan (Full-Site) · tech_fingerprint
- 2
ScanLabsAI Security Scannerscanlabsai.comwebsite read, tools not yet checked
Scans any web address for OWASP Top 10 issues, CVEs, SSL and security headers, with the first scan of each site free and connection available via MCP 2.
- 3
middleBrickmiddlebrick.comfound in code, not yet checked
Scans API endpoints for OWASP and other exposures and returns a quantified risk score, via the scan_api action 3.
+1 community tools built for it
for agents: scan_api · scan_api · list_scans
- 4
Sources
- 1ContrastAPI — Security Intelligence APIapi.contrastcyber.com · read 2026-10-29
- 2AI Website Security Scanner & Voice Assistant | ScanLabsAIscanlabsai.com · read 2026-10-29
- 3Scan Any API. Security Score in 60 Seconds, Zero Setup | middleBrickmiddlebrick.com · read 2026-10-29
- 4Semgrep App Security Platform | AI-assisted SAST, SCA and Secrets Detectionsemgrep.dev · read 2026-10-29
- 11ContrastAPI: declares "contrast_scan" (the record we read and signed)unfragile.ai · read 2026-10-24
- 14semgrep: declares "semgrep" (the record we read and signed)unfragile.ai · read 2026-10-24
For agents: the 10 actions behind this answer
contrast_scan · ContrastAPI verified and signed
Active website security scan: runs the ContrastScan C engine (11 modules — HTTP security headers, SSL/TLS, DNS, redirect chain, information disclosure, cookie flags, DNSSEC, HTTP methods, CORS, HTML hygiene, deep CSP analysis) against the live site and enriches the raw result with severity-ranked vu
· ScanLabsAI website read, tools not yet checked
AI website security scanner. Full vulnerability reports — OWASP Top 10, CVEs, SSL, security headers. First scan free, then AI credits. Connect via MCP.
scan_api · middleBrick found in code, not yet checked
Scan an API endpoint for security vulnerabilities and get a risk score
semgrep · semgrep verified and signed
Semgrep catches security vulnerabilities in real-time and guides Claude to write secure code from the start.
lighthouse · Geekflare found in code, not yet checked
Run Lighthouse audit on a website
GitGuardian/ggshield-action · GitGuardian Shield Action verified and signed
Scan commits for secrets and other issues.
scan_secrets · ship-safe verified and signed
Scan a directory or file for leaked secrets, API keys, and credentials. Returns structured findings with severity, file location, and remediation advice.
stackhawk-api · stackhawk-api verified and signed
Query the StackHawk platform API for security posture reporting, findings analysis, and app management. Guides agents through authentication, data retrieval, and result presentation.
· Sectora website read, tools not yet checked
Multi-layer application security platform. DAST, API security, supply chain analysis, secrets detection, vibe coding risk scoring, and PR security gates in one unified solution.
· Forency website read, tools not yet checked
Investigate any website's tech stack. Forency detects the CMS, frameworks, analytics, payments, CRM and 100+ technologies that matter — via REST API and MCP server, built for AI agents first.
Labels are the instruments' verdict and are never changed by ranking. Agents and robots get this same answer as JSON at /api/v1/find?q=…&answer=1 and through the MCP server.