{"name":"check-opencloud-security","title":"OpenCloud Security Scan","version":"1.31.2","description":"Public security scanning service for OpenCloud instances. Give it the URL of a publicly reachable instance and it answers with a rating from 0 to 5, the findings behind that rating, and exports in JSON, CSV, SARIF and PDF. No account, no API key, no registration.","documentation":"https://scan.okxo.de/api","apiDocumentation":"https://scan.okxo.de/api","termsOfService":"https://scan.okxo.de/privacy","sourceCode":"https://github.com/sowoi/check-opencloud-security","api":{"openapi":"https://scan.okxo.de/openapi.json","arazzo":"https://scan.okxo.de/arazzo.json","baseUrl":"https://scan.okxo.de/api","authentication":"None. Scanning is open to anyone. Only the erasure endpoint requires the operator's bearer credential, which this service does not issue."},"usage":{"asynchronous":"Scanning is asynchronous. Submission answers 202 Accepted with a uuid and the state 'queued'; the rating does not exist yet. Poll GET /api/scans/{uuid} every 3 seconds until the response carries 'done': true, which happens when the state reaches 'completed' or 'failed'. Allow up to about 5 minutes.","identifiers":"The uuid is the whole of the authorisation. Whoever has it can read that scan and nobody else can, there is no endpoint that lists scans, and an unknown, malformed or expired uuid all answer 404 alike. Treat it as a secret, do not guess one, and do not retry a 404 - the result is gone.","rateLimits":"429 is not a refusal. A client limit and a per-target cooldown both answer 429 with Retry-After in seconds; wait that long and try again, at most 3 times. A Retry-After longer than 300 seconds is a daily cap or a block for scanning hosts that were not OpenCloud: do not wait it out, tell the user. 403 means the deployment scans approved instances only. The whole scanner is open source and runs locally with no limits at all: https://github.com/sowoi/check-opencloud-security","expiry":"Results expire. Once the retention window passes the uuid stops resolving and answers 404 like any unknown one, so export or read what is needed rather than storing a uuid for later.","inputs":"A request chooses what to scan, never how hard. target_url, ignore_hardenings, release_track and output_format are the only accepted fields; anything else answers 422 naming the field. Concurrency, timeouts and TLS verification are server-side settings with no request-side equivalent.","pollIntervalSeconds":3,"maxScanSeconds":300},"capabilities":[{"name":"scan_instance","description":"Scan one OpenCloud instance and return its rating.","workflow":"scanOneInstance"},{"name":"scan_instances","description":"Scan several instances in one submission.","workflow":"scanManyInstances"},{"name":"get_scan_result","description":"Read one scan by uuid without waiting for it.","workflow":"awaitScanResult"},{"name":"plan_remediation","description":"Turn one finished scan into its rating-preserving, ordered remediation plan.","workflow":"planRemediation"},{"name":"compare_scans","description":"Compare two finished scans of the same instance and say what the changes between them achieved.","workflow":"compareScans"},{"name":"export_scan","description":"Render a finished scan as JSON, CSV, SARIF or PDF.","workflow":"exportFinishedScan"},{"name":"erase_instance_data","description":"Delete every stored scan of one instance. Destructive, and authorised by the operator's credential.","workflow":"eraseInstanceData"}],"selfHost":{"url":"https://github.com/sowoi/check-opencloud-security","note":"The whole scanner is open source and runs locally with no rate limits at all. An agent scanning more than a handful of instances should use it rather than this service."},"trademarks":"Not affiliated with, endorsed by or supported by OpenCloud GmbH. 'OpenCloud' and related marks belong to their owners and are used only to identify the software being checked.","notes":"This document is an application-level convention of this service, not a registered standard. The URLs it names are the contract; the shape of this file may change.","mcp":{"url":"https://scan.okxo.de/mcp","transport":"streamable-http","protocol":"https://modelcontextprotocol.io","description":"Model Context Protocol endpoint. Initialize against this URL and use the protocol's own tools/list, prompts/list and resources/list to discover what it offers; the tools execute the workflows described in the Arazzo document, and two of the resources are a knowledge base - the check catalogue and the advisory database - readable without submitting a scan.","prompts":[{"name":"audit_instance","title":"Audit an instance and write a remediation plan","description":"Scan one OpenCloud instance, explain the grade it earned and hand back an ordered plan of what to fix first. The everyday task.","arguments":[{"name":"target_url","description":"The instance to audit, as a URL or a hostname.","required":true},{"name":"release_track","description":"How to judge the version: auto, rolling, production or lts. Defaults to auto, which infers it from the release itself.","required":false}]},{"name":"audit_estate","title":"Audit several instances and rank them by risk","description":"Scan a list of instances in one batch and report them worst first, with the findings they share called out once rather than repeated.","arguments":[{"name":"targets","description":"The instances to audit, separated by commas or newlines.","required":true},{"name":"release_track","description":"How to judge every version: auto, rolling, production or lts.","required":false}]},{"name":"explain_scan_result","title":"Explain a finished scan in plain language","description":"Turn a scan that already exists into an explanation for a named audience - a manager, an operator or an auditor - without rescanning anything.","arguments":[{"name":"uuid","description":"The uuid a previous scan returned.","required":true},{"name":"audience","description":"Who the explanation is for, for example 'a non-technical manager' or 'the operator who runs the server'.","required":false}]},{"name":"triage_findings","title":"Turn a finished scan into tickets","description":"Convert the findings of an existing scan into one actionable ticket each, in the order the remediation plan puts them.","arguments":[{"name":"uuid","description":"The uuid a previous scan returned.","required":true},{"name":"tracker","description":"Where the tickets are going, for example GitHub, Jira or 'a plain markdown list'.","required":false}]},{"name":"review_transport_security","title":"Review the certificate and TLS configuration","description":"Look at one instance's transport security on its own: protocol version, certificate validity and expiry, chain completeness and revocation stapling.","arguments":[{"name":"target_url","description":"The instance to check, as a URL or a hostname.","required":true}]},{"name":"check_release_support","title":"Check whether the release is still supported","description":"Establish where one instance's release sits in the OpenCloud lifecycle and what upgrading it would mean, without judging anything else about it.","arguments":[{"name":"target_url","description":"The instance to check, as a URL or a hostname.","required":true},{"name":"release_track","description":"The track the operator intends to follow: auto, rolling, production or lts.","required":false}]},{"name":"verify_remediation","title":"Check whether the fixes worked","description":"Rescan an instance that was fixed since an earlier scan and report what the changes actually achieved - what is gone, what is still open, and what is new.","arguments":[{"name":"baseline_uuid","description":"The uuid of the scan the fixes were planned against.","required":true},{"name":"target_url","description":"The instance to scan again, as a URL or a hostname.","required":true}]}],"authentication":{"type":"none","note":"No token required. Connect and initialize."}}}