MCP Server

What is MCP?

Model Context Protocol is the open standard for connecting AI assistants to tools and live data. AIScan ships an MCP server so any MCP-aware client can scan a site, pull up your saved reports, track a domain over time, and read the rubric — all from inside a chat, as your account.

Two endpoints

Both endpoints run the same tools against the same account. The legacy endpoint without a key stays public and read-only: the three scan tools work, scans are not saved to any history, and account tools refuse with an explanation.

Connect with OAuth

Paste one URL — no key, no headers, nothing to leak. Your client registers itself, you approve the connection in the browser, and it refreshes on its own.

https://aiscan.site/mcp

In Claude, add it under Settings → Connectors → Add custom connector. In Claude Desktop, Cursor or Windsurf, the config file is:

{
  "mcpServers": {
    "aiscan": {
      "type": "http",
      "url": "https://aiscan.site/mcp"
    }
  }
}

Discovery follows the specs: the endpoint answers an unauthenticated call with 401 plus WWW-Authenticate, pointing at /.well-known/oauth-protected-resource (RFC 9728), which names the authorization server (RFC 8414).

Connect with an API key

Create a key at Profile → API keys and send it as a bearer token. Same key as the REST API and CLI, same account, same limits.

{
  "mcpServers": {
    "aiscan": {
      "type": "http",
      "url": "https://aiscan.site/api/mcp",
      "headers": { "Authorization": "Bearer ask_your_key_here" }
    }
  }
}

Available tools

Public — work with or without an account:

• scan_website — full scan; returns the same JSON as the REST API. Signed in, it is saved to your history and you get a reportUrl.
• get_fixes — only the failing and partial checks, with remediation and ordered fix steps.
• get_grade — score, grade, level and platform only. Good for gating.
• list_checks — every check id, its dimension, and the standards it cites.
• get_check_guidance — platform-specific fix steps for one check, without running a scan.

Account tools — need OAuth or an API key:

• whoami — plan, remaining scan/API/monitoring allowance, and whether page scans are available. Call it when a tool refuses.
• list_my_scans — your own recent scans, newest first, optionally filtered to a domain.
• get_report — a stored report by scan id, or the latest for a domain. Private reports are only ever returned to their owner.
• get_domain_history — score trend for a domain, flagged when part of the change is a rubric-version change rather than a site change.
• list_tracked_sites / track_site / untrack_site — manage scheduled monitoring.
• scan_page — page-scoped scan with a content-weighted profile. Pro only.

What a client can access

The consent screen spells this out before you approve. A connected client acts as you, and only within these bounds:

It can run scans against your monthly allowance, read your saved reports including private ones, read the score history of domains you have scanned, add or remove sites from scheduled monitoring, and read your plan, remaining allowance and account email.

It can never see your password or session, create or revoke API keys, touch billing (checkout, plan changes, coupons, refunds), change whether a report is public or private, delete your account or history, or reach any other account's data. Those stay in the web UI on purpose — see Profile → MCP connection for the same list, and disconnect from your MCP client at any time.

Plans and limits

Every tool is visible on every plan; the server enforces entitlements at call time and refuses with something you can act on rather than a bare error:

{
  "error": "plan_required",
  "message": "Per-page scans are on the Pro plan. This account is free.",
  "upgradeUrl": "https://aiscan.site/pricing"
}

Scans through MCP count against your monthly allowance exactly like the web app, CLI and REST API — see Plans & limits.

Already connected?

Nothing to do. /api/mcp keeps working with the same tool names and the same shapes. Adding an API key to an existing connection upgrades it in place: scans start saving to your history and the account tools appear. Move to /mcp when you want a key-free connection, or when your client is a Claude connector.