Plans & Limits

Every AIScan surface — the web app, the CLI, the REST API, the MCP server, the Chrome extension, and the Telegram bot — runs the same scanner and enforces the same plan rules on the server. Nothing is gated in the browser only.

What each plan gets

Founder LTD is capped at the first 100 licences, one user each, with the fixed allowances above and a fair-use policy. "Lifetime" means the commercial lifetime of AIScan.site; it is not unlimited usage. See /pricing for the current seat count.

Monthly allowances reset on the 1st of each month (UTC) and are metered server-side, so the same counters apply whether a scan comes from the web app, the CLI, the REST API, the extension, MCP or Telegram. Scheduled monitoring checks and cached results (within the 5-minute window) do not consume your scan allowance. Your current usage is shown on /profile. Pro is a flag on your account; roles are stored server-side and checked with a security-definer function — never in the browser, never in local storage.

Report visibility

Anonymous scans are always public so they can be shared by link. Once you have an account, your default_scan_public preference on /profile decides the default, and every surface honours it — including scans started from the CLI, the extension, MCP, and Telegram. You can override it per scan from the visibility control next to the URL field.

Per-page scans (Pro)

A site scan grades your origin. A page scan grades one specific URL with a content-weighted profile, and derives the site-level signals that still apply to it (sitemap inclusion, whether robots.txt permits that path). It's a Pro feature and the gate lives on the server:

# Web app  -> POST /api/scan   { "scope": "page" }
# REST API -> GET  /api/public/v1/scan?url=...&scope=page
# CLI      -> npx aiscan example.com/post --page --key $AISCAN_API_KEY

Send an API key from a Pro account as a Bearer token; free and anonymous callers get a 403.

Rate limits

• Anonymous: 5 scan requests per minute per IP.
• API key: no per-IP limit; fair use monitored.
• Identical URL + scope combinations are served from a 5-minute result cache; add fresh=1 (or use Re-scan in the UI) to bypass it. Cached responses are labelled in the UI and carry an X-AIScan-Cache header.

What a gated call returns

API errors follow RFC 9457 application/problem+json, so an agent can branch on the problem type instead of parsing prose:

HTTP/1.1 403 Forbidden
Content-Type: application/problem+json

{
  "type": "https://aiscan.site/problems/pro-required",
  "title": "Pro plan required",
  "status": 403,
  "detail": "Per-page scans require a Pro account.",
  "instance": "/api/public/v1/scan"
}

Rate limiting returns 429 with a Retry-After of 60 seconds. The CLI maps these to exit code 1 (gate failed / plan not allowed) and 3 (network or API error).