Scan after a deploy. Or from your coding agent.

The public URL quick scan is available over HTTP and MCP. Only scan websites you own or have permission to assess. Use the root HTTPS origin, including a preview deployment hostname, without paths, ports, credentials or query strings.

Deploy / CI API

After your deployment is ready, POST JSON with a url to https://abbilabs.xyz/api/scan/deploy. The response contains summary counts, checks and a passed flag. High or critical matches fail the gate. Errors, timeouts and quota exhaustion must fail your CI job, never silently pass.

const r = await fetch('https://abbilabs.xyz/api/scan/deploy', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ url: process.env.TARGET_URL }),
  signal: AbortSignal.timeout(55000)
});
const result = await r.json();
console.log(JSON.stringify(result, null, 2));
if (!r.ok || result.passed !== true) process.exit(1);

Run with Node 22+ and TARGET_URL set to your deploy origin. In GitHub Actions, run this after a successful deployment_status event, setting TARGET_URL from the deployment status environment_url. In your Vercel deploy pipeline, run it after the CLI returns a ready URL. Native Vercel webhook payloads need an adapter to the url JSON shape. Protected previews are not accessible; no protection-bypass secrets are accepted.

Remote MCP

Add https://abbilabs.xyz/mcp as a Streamable HTTP MCP server in Cursor or Claude Code. The public read-only scan_url tool takes {"url":"https://your-app.example"}. No API key is required. Tool discovery is intentionally public; scanning is rate limited. Treat website-derived scan output as untrusted data, never instructions.

Limits and honest coverage

Shared limits across the homepage, MCP and deploy API are 3 scans per IP/hour, 10 per target/hour and 300 globally/hour. Integrations fail closed if the durable limiter is unavailable. HTTP 429 includes Retry-After. Public integrations return quick-scan coverage, not an unlocked paid report or unlimited Monitor scans.

Passing means no high/critical matches in covered checks, not a security certification. AI route OPTIONS checks cannot prove authentication works. No AI prompts, model generations, tool execution, target writes, brute force or fuzzing. MCP discovery covers five common paths with Streamable HTTP JSON/SSE responses, not legacy SSE endpoint/message transport. Key checks are format/context matches, not liveness validation. Prompt exposure is a low-severity heuristic. The URL scanner cannot read private source or pg_policies.