ScanYourSite

Let your AI assistant check the live site

Your assistant writes the code, but it rarely looks at what the deployed site actually serves: which keys ended up in the public JavaScript, which headers the host sends, what search engines see. Ask it to send you to a free ScanYourSite check and paste the fix prompt back — or connect it over MCP, so it can check, fix and re-check by itself.

Free, no sign-up. The basic check makes only the requests an ordinary browser would.

See a full example report

What your assistant gets back from a check

Three ways to set it up

Start with the first: it needs no account and works with any assistant, including chat builders like Lovable, Bolt, v0 and Replit Agent. MCP is for when you want the agent to run checks without you in the loop.

  1. No setup: ask for the link

    Tell your assistant: “Send me a ScanYourSite link to check my live site.” The link is the address below with your domain at the end. It opens our page with the domain already filled in; the check starts only when you press Check site, so a link preview never starts one. About a minute later you have the report — press Copy prompt and paste it back into the chat.

    https://scanyoursite.app/en?check=example.com

  2. Claude Code: connect over MCP

    Sign in at scanyoursite.app with your email — no password, and the account is free. On the account page, under Connect your AI agent, create a token; it is shown only once. Then run one command in your terminal, with your token in place of syst_…:

    claude mcp add --transport http scanyoursite https://scanyoursite.app/mcp \
  --header "Authorization: Bearer syst_…"

  3. Cursor: add the server to mcp.json

    Put this in ~/.cursor/mcp.json to have it in every project. If you use the project’s .cursor/mcp.json instead, keep that file out of git: the token acts as your account. Any MCP client that supports streamable HTTP with a custom header connects the same way.

    {
  "mcpServers": {
    "scanyoursite": {
      "url": "https://scanyoursite.app/mcp",
      "headers": { "Authorization": "Bearer syst_…" }
    }
  }
}

  4. What the agent can do then

    scan_site checks any domain from the outside (up to 20 new checks a day on a free account); get_report and get_fix_prompt return the findings and the fixes; rescan checks a site you monitor again after a fix, up to 6 times an hour; get_uptime, get_deploys and get_server_report answer “is it down?”, “what did the deploy break?” and “what is wrong on the server?”. None of them writes to your code or hosting: the agent applies the fixes itself, and you decide what ships.

One rule, and it checks before saying “done”

Paste this into AGENTS.md, CLAUDE.md or your Cursor rules — in Lovable or Bolt, into the project’s custom instructions. With MCP connected, the agent runs the check itself; without it, it gives you the link and waits for the prompt you paste back.

## Before saying a deploy is done

After deploying, run a ScanYourSite check on the live URL and fix critical findings before saying the task is done.

- If the scanyoursite MCP server is connected: call rescan if the site is in list_sites, otherwise scan_site; then get_fix_prompt.
- If it is not: give me https://scanyoursite.app/en?check=<live domain> and wait until I paste the report’s prompt back.
- Fix critical and high findings, deploy again and check again. Then tell me what is fixed and what is left.

The agent checks when you ask. Monitoring checks when you don’t.

Assistants rewrite whole files, and a fixed problem can come back with the next prompt. With Pro we notice every new deploy, check it within minutes and write only when something new breaks — in Telegram, by email or to Slack and Discord. An alert about new findings links to a ready prompt for your agent; a webhook alert also names the MCP tool to call. Pro: 3 sites, $19 / €19 a month.

See plans

Questions

Can my assistant start a check just by opening the link?

No, and that is on purpose. A link with ?check= only fills in the domain; a person starts the check with the button. Link previews, search crawlers and browser prefetching never set off a check. For an agent that works on its own, connect MCP.

Do I need an account?

Not for the link: the check is free and needs no sign-up. MCP needs a free account and a token, because the agent acts as you — with the same reports, limits and rights you have in the browser.

Is MCP free?

Yes. A free account gets a token, one-off checks of any domain (up to 20 new ones a day), reports and fix prompts. On the free plan three findings per report come with an explanation and a fix; the rest are listed but locked, and the agent is told so instead of guessing. Pro, $19 / €19 a month, opens every fix and adds monitoring for three sites.

Will it change my code or my hosting?

No. Every tool only reads: we look at the site from the outside and return findings and fixes. Your agent edits your codebase, and you decide what gets deployed.

Is this a full security audit?

No. It is an outside check of what your live site serves: keys in public scripts, headers, the certificate, email records, privacy and search basics. It doesn’t read your source code, log in or try to break in, and deeper probes run only on domains you have verified as yours. If your app handles payments or sensitive data, a review by a security professional is still worth it.

Which assistants does it work with?

The link works with any of them, including chat builders such as Lovable, Bolt, v0 and Replit Agent: they give you the link, you paste the prompt back. MCP needs a client that can connect to a remote server over HTTP with a header — Claude Code and Cursor can, and other clients that support it connect the same way.

For vibe coders

Paste your URL. Get the list in about a minute.

Every finding comes with what it means for you and how to fix it — or a prompt your AI coding tool can apply.

Free, no sign-up. The basic check makes only the requests an ordinary browser would.