Scan.now CLI and Agent Skill for Security Scans

What the skill lets an agent do

An agent skill is a plain-text set of instructions. This one tells a compatible agent how to choose and use the two tools exposed by the public Scan.now MCP server at https://mcp.scan.now.

Run authorised passive website scans

After the user confirms ownership or explicit permission, the agent can request a full scan or focus on TLS, security headers, email-domain posture or public JavaScript.

Inspect a suspicious link

The agent can follow a public link's redirects and explain phishing signals without submitting a form, logging in or treating a low risk score as a guarantee.

Keep the safety boundary explicit

The instructions prohibit exploitation, access-control bypasses, credential guessing and private-network scans. The website tool requires permission before it is called.

How to use it

Install the published skill into your active OpenClaw workspace with one command:

Terminal

openclaw skills install @Henrick86/scan-now-tools

Connect the MCP server. Add https://mcp.scan.now as a Streamable HTTP MCP server in a compatible agent host. It is anonymous and exposes two read-only tools.
Install the instructions. Use the OpenClaw command above, or download SKILL.md into a skill folder named scan-now-tools.
Start a new agent session. Ask it to check a suspicious link, or state that you own a website and ask for a full or focused security review.

The skill and the server are separate.

The skill teaches the agent when and how to act; the MCP connection supplies the tools that perform the checks. Installing only the Markdown file does not grant network access or silently connect the agent to Scan.now.

Example requests

“I own example.com and authorise a passive security scan. Check it for security problems.”
“I administer example.com. Review its TLS configuration and security headers.”
“Does this public link look like phishing, and where does it redirect?”

Read the complete SKILL.md

This is the canonical file bundled with the Scan.now Agent Plugin and served by the download above. It contains no executable code, install script, token or credential.

scan-now-tools/SKILL.md

---
name: scan-now-tools
description: Use Scan.now when the user wants a passive security assessment of a website they are authorized to test, or wants to inspect a suspicious public link for phishing signals.
---

# Scan.now tools

Connect to the public Streamable HTTP MCP endpoint at `https://mcp.scan.now`.
No API key, account, or environment variable is required. Do not ask the user to obtain
a Scan.now credential, and do not invent REST endpoints; use the MCP tools exposed by
that server.

Use `scan_website_security` only after the user states that they own the target website
or have explicit permission to assess it. If that authorization is absent, ask for it
before calling the tool. Set `authorized` to true only after that confirmation.

Call it with:

- `url`: the public HTTP or HTTPS website to assess.
- `authorized`: `true` only after the user's confirmation.
- `scope`: optional; one of `full`, `tls`, `headers`, `email`, or `js`.

Choose the narrowest useful scope:

- `full` for a broad passive assessment.
- `tls` for certificates, protocol support, and HTTPS behavior.
- `headers` for HTTP security headers, cookies, CORS, and related page controls.
- `email` for SPF, DKIM, DMARC, DNSSEC, CAA, and email-domain posture.
- `js` for public JavaScript inventory and known vulnerable library versions.

Use `check_phishing_link` when the user wants to understand whether a public link looks
deceptive or where it redirects. Explain that a low score is not a guarantee: a new or
unreported phishing page may not yet appear on blocklists.

Call it with `url` and, optionally, `follow_redirects` (default `true`). This tool does
not require the website-ownership confirmation because it inspects a link rather than
assessing a user's website.

These tools are passive and read-only. They do not exploit findings, bypass access
controls, guess credentials, scan private networks, or prove that a target is secure.
Do not help use the results for unauthorized access. Prefer the finding's
`reference_url` when the user asks how to fix an issue.

Use `https://scan.now/methodology` when the user asks how the checks work and
`https://mcp.scan.now/privacy-policy` for MCP-specific data handling.

Limits worth knowing

These are point-in-time, public-surface checks. They do not prove a site is secure, reach private application state, authenticate as a user or exploit a finding. New phishing pages may not yet appear on reputation lists, so the link check reports evidence and uncertainty rather than a promise of safety.

For the exact requests made by each scanner, see how Scan.now scans. MCP-specific data handling is covered by the MCP privacy policy.