Web Scan
Your coding agent shipped it. Web Scan checks it.
One call audits any live URL in about 5 seconds: 85 checks across SEO, AI search (GEO), security headers, leaked API keys, Core Web Vitals and accessibility. Every finding comes with the exact fix, ranked by how many points it is worth. Then your agent fixes it and verifies the fix on the live site, without you re-running anything.
Free. No sign-up. No API key. Works as an MCP server, a GitHub Action, a CLI and on the web.
scan_url → fix → deploy → verify_fixes → allFixed: true
Why agents use it
- Built for the agent loop.
scan_urlfinds what is wrong,verify_fixesproves each fix landed in production, per check id. No screenshots to read, no dashboards to click. - Fixes, not findings. Each failing check returns its id, what was found on the page, and a concrete fix. Findings are ranked by real score gain (the report is re-scored with that one fix applied), so the agent works in the order that matters.
- Catches what AI-built apps leak. Reads the JavaScript the site serves to every visitor and finds live
secret keys (OpenAI, Anthropic, Stripe, AWS, GitHub, Slack, SendGrid, database URLs, private keys) and
Supabase
service_rolekeys. Every match gets a second look that drops placeholders and docs examples, so a red result is a real leak. - Sees the page the way AI search does. Shows what ChatGPT, Claude and Perplexity crawlers actually receive (no JavaScript), which AI bots robots.txt lets in, and whether the page answers the questions buyers ask.
- Honest scoring. One number from three parts (search and sharing, security, speed), capped when a critical check fails, next to a benchmark of 25 well-known sites. Missing security headers are hardening notes, not holes. Unsure findings say "needs checking".
- Safe to point at anything public. Passive only: it reads what the site already serves and never probes hidden paths. Text from scanned pages is returned as data, never as instructions.
MCP server
Remote, stateless, Streamable HTTP. No key needed.
https://preflight-api.agentmarket.lol/api/mcp
Claude Code
claude mcp add --transport http web-scan https://preflight-api.agentmarket.lol/api/mcp
Cursor (~/.cursor/mcp.json), Windsurf, VS Code (.vscode/mcp.json, key servers)
{
"mcpServers": {
"web-scan": { "url": "https://preflight-api.agentmarket.lol/api/mcp" }
}
}
Codex (~/.codex/config.toml)
[mcp_servers.web-scan]
url = "https://preflight-api.agentmarket.lol/api/mcp"
Tools
Try it in your agent:
Scan https://my-app.com with Web Scan, fix everything in this repo in order of points, and verify the fixes once I deploy.
GitHub Action
Fail the build when a deploy makes the site worse.
- uses: ankitkumarjha515/web-scan@v1
with:
url: https://my-app.com
min-score: 85 # fail below this score
fail-on: score # score | failures | any | never
Writes a summary table to the job page, with a link to the full interactive report. Pair it with a preview deployment to catch problems before they reach production.
CLI
No dependencies, Node 18+.
node bin/web-scan.mjs https://my-app.com --min-score 90
node bin/web-scan.mjs https://my-app.com --fail-on failures --json
Exit code 0 passes, 1 fails the gate, 2 means the scan could not run. Every run ends with a link to the full report on the website: charts, the AI search view, link previews and a live speed test.
What it checks
Every report also says what kind of site it is (shop, local business, software, publisher, agency), the basics that kind of site needs, and what the scan covered and what it could not see.
Whole-site audits, competitor comparison, hourly monitoring and a README badge are on the website.
Limits
- Public URLs only: no localhost or private networks. Use a preview deployment.
- Fair-use rate limits per IP; sign in on the website for higher limits.
- One page per
scan_urlcall; use the website for whole-site crawls.
License
MIT for this repository (Action, CLI, registry metadata). The scanner itself runs as a hosted service.