API & AI Automation

Integrate SecureScan into your tools — or let an AI handle the scans.

In plain words

What it is

SecureScan isn't only a website to use by hand: it's also a service other programs can drive on your behalf. That means you can start security scans automatically, without opening the browser and clicking every time.

Who it's for

For web agencies, IT teams and developers who manage many sites, but also for anyone who simply wants to automate checks without being an expert.

What it's for

Automatic, recurring security checks (e.g. weekly) on sites and servers.
Integrating scans into your business tools or development pipeline.
Letting an AI assistant handle it: you ask in plain language to check a site and it launches the scan and summarises the results.
Saving time: no repetitive manual work.

Technical part

How to connect and use it with AI

1. Create an API key

In the dashboard, “🔑 API Keys” menu, generate a personal key (ss_live_…). It replaces email and password and is shown only once.

2. Call the REST API

Pass the key in the Authorization: Bearer header on every request. Example: launch a full scan on one of your domains.

3. Connect an AI agent (MCP)

With the SecureScan MCP server an agent like Claude gets the tools to launch scans and read results. Configure it with your API key: then you can simply ask the AI to check a site.

Practical example

Launching a full scan via cURL:

curl -X POST https://penetration-test.net/api/v1/scans/v2 \
  -H "Authorization: Bearer ss_live_..." \
  -H "Content-Type: application/json" \
  -d '{"target":"example.com","profile":"full"}'

AI agent configuration (MCP)

Add SecureScan as an MCP server (e.g. Claude Desktop):

{
  "mcpServers": {
    "securescan": {
      "command": "python",
      "args": ["-m", "securescan_mcp"],
      "env": {
        "SECURESCAN_API_KEY": "ss_live_...",
        "SECURESCAN_BASE_URL": "https://penetration-test.net"
      }
    }
  }
}

Then just ask in natural language, for example:

“Check the security of example.com and tell me if there are any critical vulnerabilities.”

Good to know

Ownership: you can only scan domains/IPs verified as yours (DNS record or verification file).
Credits: each scan consumes account credits — check the balance before automating.
Security: API keys cannot access admin features and can be revoked at any time.

Go to your API Keys

Free diagnostic tools

Synchronous tools, no mandatory login, no limits for registered users.

🗺️