Deep security scan of an app you control
deep_scan_appUse this when the user, or the agent building the app, wants to check an app they control for exposed files and leaked secret keys before launch. A deeper security scan than check_app_security, for an app the caller controls (for example one the agent itself is building). It looks for sensitive things left publicly reachable: an environment (.env) file, an exposed .git folder, a directory listing, or a published source map. It also reads the app's own public code (the home page and its scripts) for the Supabase project it uses and for secret keys shipped to the browser (a Supabase service role or secret key, a database password, a paid AI key). It never contacts the app's database, never writes, and never stores, logs or returns any key; it reports the exposed PATH or the KIND of key, never a file's contents or a secret value. Because it probes an app directly, each scan runs only after ownership is proven now: call it once to receive a one-time code and a check id, add the code to the app (a meta tag on the home page, or a line in /7it-verify.txt), then call again with the check id and the scan runs.
Tool call template
Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.
{
"id": 1,
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"arguments": {
"url": "<url>"
},
"name": "deep_scan_app"
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | The app’s public web address, for example myapp.com or https://myapp.lovable.app. You must be able to add a verification code to this app. | |
| check | No | The check id the first call returned, after the one-time code is on the app |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| code | No | One-time verification code to place on the app (30 minutes) | |
| host | No | ||
| check | No | The check id to pass on the next call, once the code is on the app | |
| clean | No | True when no exposed file was found | |
| token | No | The site's ownership token (for the 7IT Guard watch; it no longer unlocks a scan by itself) | |
| backend | No | The Supabase project the public code names, and how many secret keys it carries (the database is never contacted) | |
| findings | No | Exposed paths, plus secret keys in the public code by kind; file contents and key values are never returned | |
| verified | No | ||
| report_url | No | ||
| needs_verification | No | True when ownership is not proven yet; add the code and call again with the check id |