OpenCloud Security Scanner Logo Security scan for OpenCloud

The API

Scanning from a script or an agent

Use the JSON API to submit scans, check their progress and download results. Scripts and agents use the same scanning service and limits as the browser form.

Submit & poll

Submit and poll

curl -X POST https://scan.okxo.de/api/scans \
     -H 'Content-Type: application/json' \
     -d '{"target_url": "opencloud.example.com", "release_track": "production"}'
curl https://scan.okxo.de/api/scans/<uuid>

Submitting a scan returns 202 and its identifier. Polling returns queued, running or the completed result. Expired scans return 404. You can supply four fields: the address, checks to waive, release track and output format. Other fields are rejected. The operator sets concurrency and timeouts.

Fair use

Fair use

This deployment allows 10 submissions per 1 minute(s) from one address, with one scan per target every 5 minute(s). Exceeding either limit returns 429 and a Retry-After header. At most 50 scans per network per day. A network whose scans keep finding no OpenCloud is paused for a while. You can also run the scanner on your own machine without these limits: get the source on GitHub.

The schema

The schema

The machine-readable documents are always public, on this deployment and on every other: the OpenAPI 3.1 description of every operation, and the Arazzo 1.0.1 workflows that say how those operations combine into submitting a scan, waiting for completion and retrieving the result. Browse the API with Swagger UI or ReDoc. Both viewers load their resources from this server, without third-party requests.

AI agents

Start from one address

Agents can discover the API operations and scanning workflows through the public documents below. These descriptions are available without an account.

  • Discovery - /.well-known/ai.json names all of the below, with absolute URLs. Start here.
  • OpenAPI - /openapi.json, every operation with its real status codes and response shapes.
  • Arazzo workflows - /arazzo.json, the lifecycle of a scan: submit, poll, detect completion, export.
  • MCP - https://scan.okxo.de/mcp, a Model Context Protocol endpoint over streamable HTTP. Tools: scan_instance, scan_instances, get_scan_result, plan_remediation, export_scan and erase_instance_data. scan_instance does the whole task - submission, waiting and result - in one call. Prompts name the jobs themselves, such as audit_instance, which audits an instance and writes the remediation plan, and review_transport_security, which looks only at the certificate and the handshake. It answers the protocol rather than a browser, so it is an address to configure rather than a page to open.

OpenAPI defines the operations, Arazzo describes the workflows, and MCP exposes those workflows as tools for agents. They use the same service implementation.

In the browser

Use the page as a tool

A browser that supports the WebMCP draft can discover actions from the page already open. There is no separate client to configure.

  • On the landing page, scan_opencloud_security queues a scan. Its schema contains the release tracks, output formats and waiver identifiers offered by that page.
  • On a result page, get_scan_result reads the current scan and export_scan_report downloads JSON, CSV, SARIF or PDF for the uuid already being viewed.
  • Every browser tool calls the same JSON API with Accept: application/json. It keeps the SSRF guard, rate limits, target cooldown, queue and uuid isolation in place.

WebMCP is still a draft and is ignored by browsers that do not implement it. Turning MCP off for this deployment removes the browser tools too.

Configuration

Configure an agent client

Configure your client with the endpoint URL and the streamable HTTP transport. If the operator requires authentication, you will also need to sign in.

{"type": "http", "url": "https://scan.okxo.de/mcp"}

Worked configuration for Claude Code, Claude Desktop, GitHub Copilot in VS Code and the CLI, Cursor, Zed and Windsurf - against this deployment or one of your own - is in the MCP guide.

The rules

The same rules as everybody else

The rules are the same for an agent as for anybody else. A scan is asynchronous and the uuid is the only way back to it; a 429 is an invitation to slow down rather than a refusal; and if you are checking more than a handful of instances, please run the scanner yourself - it is the same code, on your machine, with no limits.