The request names no specific product, so these are candidates for scanning a website for security issues. ContrastAPI offers a full-site active scan covering HTTP security headers, SSL/TLS, DNS and redirect chains 111, making it the closest match. Google Cloud Web Security Scanner 414 and ScanLabsAI 7 also target web security scanning, though their evidence is thinner. Semgrep 515 and Ship Safe 919 scan source code rather than live websites, and Firecrawl 212 and Oxylabs [
A question back: Do you want to scan a live website or API for exposed weaknesses, or scan your own source code?
- 1
ContrastAPIcontrastcyber.comverified and signed
Runs an active website security scan through the ContrastScan C engine, checking HTTP security headers, SSL/TLS, DNS, redirect chains and information disclosure, with a full-site variant 11.
official:MCP server · ContrastAPI
for agents: contrast_scan · Contrast Scan (Full-Site) · Domain Audit
- 2
Google Cloud Web Security Scannergoogle.comverified and signed
Creates and starts scan configurations that run a ScanRun against a web application 14.
official:API · Web Security Scanner API
for agents: websecurityscanner.projects.scanConfigs.start · websecurityscanner.projects.scanConfigs.get · websecurityscanner.projects.scanConfigs.create
- 3
ScanLabsAIscanlabsai.comwebsite read, tools not yet checked
AI website security scanner producing vulnerability reports covering OWASP Top 10, CVEs, SSL and security headers, connectable via MCP.
- 4
middleBrickmiddlebrick.comfound in code, not yet checked
Scans an API endpoint for security vulnerabilities and returns a risk score .
+1 community tools built for it
for agents: scan_api · scan_api · list_scans
- 5
Semgrep App Security Platformsemgrep.devverified and signed
Scans source code for security vulnerabilities with SAST, SCA and secrets detection, rather than scanning a live website 15.
+4 community tools built for it
for agents: semgrep · semgrep · code-security
Sources
- 1ContrastAPI — Security Intelligence APIapi.contrastcyber.com · read 2026-10-29
- 2Firecrawl | Web Data API for AI Agentsfirecrawl.dev · read 2026-10-29
- 3Scan Any API. Security Score in 60 Seconds, Zero Setup | middleBrickmiddlebrick.com · read 2026-10-29
- 4AI and Cloud Computing Services | Google Cloudcloud.google.com · read 2026-10-29
- 5Semgrep App Security Platform | AI-assisted SAST, SCA and Secrets Detectionsemgrep.dev · read 2026-10-29
- 7AI Website Security Scanner & Voice Assistant | ScanLabsAIscanlabsai.com · read 2026-10-29
- 9Ship Safe — AI Agent Security Scanner for Developersshipsafe.sh · read 2026-10-29
- 11ContrastAPI: declares "contrast_scan" (the record we read and signed)unfragile.ai · read 2026-10-24
- 12firecrawl-py: declares "API" (the record we read and signed)unfragile.ai · read 2026-10-24
- 14Web Security Scanner API: declares "websecurityscanner.projects.scanConfigs.start" (the record we read and signed)unfragile.ai · read 2026-10-24
- 15semgrep: declares "semgrep" (the record we read and signed)unfragile.ai · read 2026-10-24
- 19ship-safe: declares "scan_secrets" (the record we read and signed)unfragile.ai · read 2026-10-24
For agents: the 10 actions behind this answer
contrast_scan · ContrastAPI verified and signed
Active website security scan: runs the ContrastScan C engine (11 modules — HTTP security headers, SSL/TLS, DNS, redirect chain, information disclosure, cookie flags, DNSSEC, HTTP methods, CORS, HTML hygiene, deep CSP analysis) against the live site and enriches the raw result with severity-ranked vu
API · firecrawl-py verified and signed
scan_api · middleBrick found in code, not yet checked
Scan an API endpoint for security vulnerabilities and get a risk score
websecurityscanner.projects.scanConfigs.start · Web Security Scanner API verified and signed
Start a ScanRun according to the given ScanConfig.
semgrep · semgrep verified and signed
Semgrep catches security vulnerabilities in real-time and guides Claude to write secure code from the start.
list_scrapers · web-api-mcp found in code, not yet checked
List the scrape endpoints this API implements, or describe one of them.
· ScanLabsAI website read, tools not yet checked
AI website security scanner. Full vulnerability reports — OWASP Top 10, CVEs, SSL, security headers. First scan free, then AI credits. Connect via MCP.
· FourA website read, tools not yet checked
Web scraping API with smart proxy rotation, browser-grade requests and real-time monitoring. One API call, any public website. Free to start.
scan_secrets · ship-safe verified and signed
Scan a directory or file for leaked secrets, API keys, and credentials. Returns structured findings with severity, file location, and remediation advice.
GitGuardian/ggshield-action · GitGuardian Shield Action verified and signed
Scan commits for secrets and other issues.
Labels are the instruments' verdict and are never changed by ranking. Agents and robots get this same answer as JSON at /api/v1/find?q=…&answer=1 and through the MCP server.