Skip to main content
Glama

urlscan_lookup

Search urlscan.io's public scan database (keyless) for a domain or IP: recent public scans of the site itself (its own pages, not other sites that merely load something from it) with each page's final URL, resolved IP, hosting country/server/ASN, and links to the scan result and its screenshot, plus a roll-up of the related domains urlscan saw serving the pages. Reads urlscan's data, never the target. A caller can pass a raw urlscan field query (e.g. ip:1.2.3.4). Read-only.

Input Schema

NameRequiredDescriptionDefault
targetYesDomain to search, e.g. example.com (or a raw urlscan query like ip:1.2.3.4)

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observed

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are supplied, so the description carries the full burden, and it does substantial work: 'keyless' (no auth required), 'Read-only', and 'Reads urlscan's data, never the target' clearly characterize the operation. It also enumerates the returned data points. It omits pagination, result caps, and any rate-limit behavior for an external API.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the core action and data source, then layers the scope restriction and return contents in a single dense sentence. Every clause is informative, though the long parenthetical makes it heavier than it needs to be.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description compensates well by describing the fields returned (final URL, resolved IP, hosting country/server/ASN, links to result and screenshot, related-domain roll-up) and by flagging keyless read-only semantics. Missing only edge-case behavior such as no-results handling or limits.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% for the single parameter, so the schema already documents the expected domain format. The description's mention of a raw urlscan field query (`ip:1.2.3.4`) largely restates what the schema description already states, adding little beyond the baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (Search) against a specific resource (urlscan.io's public scan database) and precisely scopes it: scans of the site itself, explicitly excluding 'other sites that merely load something from it'. The phrase 'Reads urlscan's data, never the target' cleanly separates it from live-scan siblings like scan_site.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives clear context for when to reach for it (keyless, historical public scan data, domain or IP) and hints at the alternative by noting it never touches the target. It stops short of naming a specific sibling such as scan_site or passive_dns as the substitute for live or DNS-history lookups.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources