Scannd Documentation

Scannd runs Nuclei against the domains registered on your account and saves the findings to a report. How many classes of check run depends on your plan's scan depth (see Scan Tiers & Depth). You can trigger scans and read results from the web dashboard, the REST API, or an AI assistant over MCP.

Multi-target scanning is live. The Targets page in the sidebar adds and removes targets, and its Run Scan bar enqueues one scan per target you select. Two things to know: the dashboard's own scan button is the older single-scan path and runs against your account's registered domain, and adding targets is metered per calendar month on top of the concurrent limit (Free 2, Solo 6, Startup 20, Agency and Partner unlimited), so rotating domains through a small plan's slots is not unlimited.

Scannd has two ways in: Auth0 for the web console, and API keys for programmatic and MCP access.

A scan runs against a domain registered on your account (you can't point a scan at an arbitrary URL). You can start one three ways:

• Dashboard. The scan button in the console triggers a scan of your account's registered domain at your plan's depth. The Targets page has its own Run Scan bar, which enqueues one scan per target you tick.
• REST API. POST /api/mcp/v1/scan with your API key (see API Reference).
• MCP. The trigger_scan tool, so an AI assistant can start a scan for you (see MCP Integration).

Scan lifecycle

A triggered scan moves through these statuses. The dashboard scan button and the MCP trigger_scan tool allow only one scan at a time per account; starting a second while one is in progress returns a conflict. The Targets page fan-out is the exception: it enqueues one scan per target you selected, and those queue against the platform's shared scan capacity rather than all starting at once.

Scans take a few minutes. Poll status with get_scan_status (MCP) or GET /api/mcp/v1/scan/{scan_id}/status. When a scan completes, the report is saved and emailed to you.

You can also opt in to weekly scheduled scans per target on the Targets page; enrolled targets are scanned automatically once a week.

Your plan maps to a scan depth, which controls how many classes of check Nuclei runs. Depths are a strict superset ladder: each deeper level runs everything the level below it does, plus more.

What each depth runs

Every completed scan produces a report, stored against your account and emailed to you. You can also read reports programmatically, over the REST API or through MCP tools.

Retrieving results

• list_reports: recent reports (metadata only): id, filename, created_at.
• get_report: a specific report by id, or the latest, with its full findings list.
• get_vulnerabilities: findings from a report, optionally filtered by severity.
• get_domain_summary: a roll-up of your tier, total scans, last scan time, and vulnerability counts by severity.

Reading a finding

Each finding carries the fields below. Severity is one of critical, high, medium, low, or info.

{
  "name": "string",         // the check that matched
  "severity": "critical | high | medium | low | info",
  "url": "string",          // where it was found
  "description": "string",
  "template_id": "string"   // the Nuclei template
}

The domain summary rolls these up into counts: { "critical", "high", "medium", "low", "info" }.

Connect Scannd to Claude, Cursor, or any MCP-compatible AI assistant to trigger scans, pull findings, and check your domain's posture from a conversation. The scannd-mcp server exposes eight tools backed by the REST API.

Setup

Generate an API key, then add this to your MCP client's config (e.g. claude_desktop_config.json):

{
  "mcpServers": {
    "scannd": {
      "command": "npx",
      "args": ["scannd-mcp"],
      "env": {
        "SCANND_API_KEY": "sk_your_key_here"
      }
    }
  }
}

How it authenticates

Tool reference

{ "workflow"?: "free" | "standard" | "professional", "target_id"?: number, "domain"?: "string" }

{ "scan_id": "string", "status": "queued", "message": "string" }

{ "scan_id": "string" }

{ "scan_id": "string", "status": "queued" | "running" | "completed" | "failed" }

{ "limit"?: number }  // default 10, clamped to 1–50

{ "reports": [{ "id": number, "filename": "string", "created_at": "string | null" }] }

{ "report_id"?: "string" }  // omit for latest

{ "report_id": number, "created_at": "string | null", "findings": [...] }

{ "report_id"?: "string", "severity"?: "critical" | "high" | "medium" | "low" | "info" }

{ "report_id": number, "findings": [{ "name", "severity", "url", "description", "template_id" }] }

none

{ "domain", "tier", "total_scans", "last_scan_at", "vuln_counts": { "critical", "high", "medium", "low", "info" } }

none

{ "workflows": [{ "name", "description", "tag_count" }] }

none

{ "targets": [{ "id", "domain", "label" }] }

Base URL https://api.scannd.com. All responses are JSON.

MCP REST API (v1)

These endpoints authenticate with an X-API-Key header and back the eight MCP tools. (get_report maps to two routes (/reports/latest and /reports/{id}), so nine routes serve eight tools.)

API key management

These endpoints manage your keys and are used by the authenticated dashboard (Auth0 session, scoped to your auth0_user_id). The raw key is returned only on creation.

The dashboard also uses a set of authenticated console endpoints (scan trigger, domain, reports, subscription, and weekly-scan preference). Those are console-internal and not part of the public developer API documented here.

Scan limits apply to the scans you trigger via MCP / the REST API. Only the Free tier is capped; every paid plan runs unlimited scans.