Integration

urlscan.io integration

urlscan.io API v1 for URL scanning: submit a URL for analysis, poll until the scan is ready, read the structured verdicts and page metadata, search historical scans with the urlscan query syntax, and download the rendered screenshot. Scanning is asynchronous: a submission returns a uuid that becomes readable a few seconds later.

Connect urlscan.io How integrations work

Ask it in chat

Say what should happen.
The workflow builds itself.

When this happens, do that in urlscan.io.Built from the 6 urlscan.io tools below, on the connection you add once.

Common urlscan.io use cases

previewing a link before opening it
deciding whether a link is malicious
triaging a suspicious link from an email
attaching visual evidence to a phishing report
finding every past scan of a suspicious domain
checking capacity before scanning a batch of URLs
diagnosing refused calls
generating a thumbnail for a page
capturing evidence of a phishing page
showing an analyst what the page looked like

What you can do with urlscan.io

Each of these is one operation on one endpoint, available both as a workflow step and as a tool an AI agent can call on its own. Nothing bundles several operations into one action, so what a run did stays readable afterwards.

Most endpoints run on the free plan. A few, mainly the ones that publish on your behalf, need a paid plan.

Scan, 3 operations

get_scan_resultGet scan resultGETRetrieves the full urlscan.io report for a scan.
search_scansSearch scansGETSearches historical urlscan.io scans by query.
submit_scanSubmit scanPOSTSubmits a URL to urlscan.io for scanning.

Screenshot, 2 operations

get_liveshotGet liveshotGETTakes an immediate screenshot of a URL.
get_screenshotGet screenshotGETDownloads the screenshot of a urlscan.io scan.

Quota, 1 operation

get_quotasGet quotasGETReturns the remaining urlscan.io quotas for the account.

Use urlscan.io from Claude Code, Cursor or Codex

Connect urlscan.io in LiveContext, create an API key in Settings, then add the LiveContext MCP server to your client. Its urlscan.io operations become tools the client can call, next to every other integration you connected.

Claude Code

claude mcp add --transport http livecontext https://livecontext.ai/mcp --header "X-API-Key: YOUR_API_KEY"

Codex (~/.codex/config.toml)

[mcp_servers.livecontext]
url = "https://livecontext.ai/mcp"

[mcp_servers.livecontext.http_headers]
"X-API-Key" = "YOUR_API_KEY"

Cursor, Claude Desktop and other JSON configs

{
  "mcpServers": {
    "livecontext": {
      "type": "http",
      "url": "https://livecontext.ai/mcp",
      "headers": {
        "X-API-Key": "YOUR_API_KEY"
      }
    }
  }
}

Set up the MCP server step by step

How to connect urlscan.io

Create your workspace
Sign up free. Nothing to install.
Connect urlscan.io once
Add your urlscan.io connection in Settings. Every tool from this integration reuses it, and secrets are encrypted at rest and visible only to you.
Describe the job in chat
The workflow builds itself in front of you and picks the endpoints it needs. Drag the steps yourself on the canvas whenever you would rather be explicit.

urlscan.io integration FAQ

What can you do with the urlscan.io integration?

LiveContext exposes 6 operations on urlscan.io, covering scan, screenshot and quota. Common uses include previewing a link before opening it, deciding whether a link is malicious and triaging a suspicious link from an email.