Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@Eleion Scanner MCP Register my domain example.com and start a basic scan."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Drive the Eleion security scanner from an AI agent: register one of your own
domains, prove ownership, queue a security scan (headers, TLS, DNS, ports, tech-fingerprint, plus
AI-specific checks), and read the findings — severity, CVE, title, priority. Wraps the hosted Eleion
Scanner API (https://scanner-api.eleion.io).
Tool | What it does |
| Register one of your domains; returns the DNS TXT / well-known record to publish for ownership proof. |
| Verify the ownership record you published. |
| Queue a scan ( |
| Poll a scan's status and finding count. |
| List the findings (severity, CVE, template, title, priority). |
Related MCP server: domain-security-mcp-server
{
"mcpServers": {
"eleion-scanner": {
"command": "npx",
"args": ["-y", "eleion-scanner-mcp"],
"env": { "SCANNER_API_KEY": "your_tenant_key" }
}
}
}Get a tenant key at https://scan.eleion.io. You can only scan domains you have registered and verified ownership of — this is not an arbitrary-target scanner.
The scan worker runs the analysis server-side; large scans take time, so poll scanner_get_scan_status
until completed. Your registered domains and findings are processed by the hosted API. MIT licensed.
List the security findings of a completed scan (severity, CVE, template, title, URL, priority_score), ordered by priority.
| Name | Required | Description | Default |
|---|---|---|---|
| scan_id | Yes | The scan id. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description bears full burden. It discloses that the tool is read-only (listing), specifies returned fields and ordering, and implies the scan must be completed. No contradictions. Missing details like pagination or error states, but adequate for a simple list tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence with 21 words, no filler. Front-loaded with verb and resource, efficiently communicates purpose and output characteristics (fields, ordering). Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with no output schema, the description adequately explains return values (listing fields and ordering). Combined with sibling names, the usage context is clear. No missing crucial information for agent decision-making.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% (the single 'scan_id' parameter is already documented in the schema with a basic description). The description adds the constraint that the scan must be completed, which adds modest semantic value beyond the schema. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('List') and resource ('security findings of a completed scan'), lists key fields, and clearly distinguishes from sibling tools (e.g., scanner_get_scan_status, scanner_start_scan) by focusing on results rather than status or initiation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states 'of a completed scan', implying the scan must be finished before using this tool. It provides clear context but does not explicitly mention when not to use it or name alternative tools for different scenarios.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Get the status of a scan (queued|running|completed|failed) and how many findings it has.
| Name | Required | Description | Default |
|---|---|---|---|
| scan_id | Yes | The scan id. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. It honestly discloses that the tool returns the scan status and findings count, and implies no side effects (read-only). Additional context about permissions or rate limits would improve transparency but is not critical.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence with no wasted words. The primary action ('Get the status') is front-loaded, and the relevant information (status values, findings count) is included efficiently.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given low complexity (one parameter, no output schema), the description is complete. It explains the return value (status and findings count) and the possible statuses, which is all an agent needs to invoke and interpret the result.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so baseline is 3. The description does not add any new meaning for the parameter 'scan_id' beyond what the schema already provides ('The scan id.').
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states verb 'Get', resource 'status of a scan', and lists possible status values (queued|running|completed|failed). It also mentions the count of findings, which distinguishes it from sibling tools like scanner_get_findings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies that this tool is for checking scan status, but it does not explicitly state when to use it (e.g., after starting a scan) or when to prefer alternatives like scanner_get_findings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Register one of YOUR OWN domains/URLs to be security-scanned. Returns a verification_token plus the DNS TXT record (or /.well-known URL) you must publish to prove ownership before scanning. You can only scan domains you own.
| Name | Required | Description | Default |
|---|---|---|---|
| target_url | Yes | The http(s) URL/domain to register (must be a public host you control). |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. It discloses the verification flow (token + DNS TXT record) and ownership requirement, which are key behavioral traits. It does not detail rate limits or side effects, but the core behavior is transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three concise sentences, front-loaded with the purpose. Each sentence adds value: registration action, verification details, and ownership constraint. No fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (one parameter, no output schema, no annotations), the description covers the registration process and ownership requirement adequately. It could mention error scenarios but is sufficiently complete for an agent to use correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The single parameter 'target_url' is well-described in the schema (public host you control). The description adds ownership context but does not significantly extend the schema's description. Since schema coverage is 100%, baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool registers domains/URLs for security scanning, using a specific verb and resource. It distinguishes from sibling tools like scanner_start_scan and scanner_verify_target by focusing on the registration step.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains that registration is for domains you own and that verification is required before scanning. It implies usage context (before scanning) but does not explicitly state when not to use or provide alternatives, though it's clear enough for an agent.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Queue a security scan over a target you have already registered AND verified. Returns a scan_id and status. Poll scanner_get_scan_status until completed, then read scanner_get_findings.
| Name | Required | Description | Default |
|---|---|---|---|
| target_id | Yes | The verified target id. | |
| scan_profile | No | Scan depth. | basic |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Without annotations, the description discloses that the tool queues a scan, returns a scan_id and status, and requires polling. It does not detail response structure or error conditions, but provides sufficient behavioral context for a queueing tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences that front-load the core action and prerequisites, then add the workflow. No fluff; every sentence is informative.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with two parameters and no output schema, the description adequately covers what, prerequisites, and follow-up steps. It lacks details on error handling or concurrency limits, but remains complete enough for effective use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, and the description adds context by emphasizing the prerequisite for target_id (registered and verified). It also mentions the return value (scan_id, status) which ties to parameters indirectly.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool queues a security scan over a previously registered and verified target. It distinguishes itself from sibling tools like scanner_get_scan_status and scanner_get_findings by describing the workflow.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states prerequisites (target must be registered and verified) and provides a clear workflow: queue, then poll scanner_get_scan_status, then read scanner_get_findings. This tells the agent exactly when and how to use the tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Verify domain ownership of a previously registered target by checking the DNS TXT / .well-known record you published. Returns whether verification succeeded.
| Name | Required | Description | Default |
|---|---|---|---|
| target_id | Yes | The target id returned by scanner_register_target. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses the verification method and that it returns success/failure, but omits details like whether the operation is read-only, idempotent, or requires special permissions. Minimal but adequate for a simple check.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, each carrying essential information: action and return value. No unnecessary words, front-loaded with the core purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, the description explains the return ('whether verification succeeded') adequately for a simple boolean result. However, it does not specify the exact response format or error conditions. For a single-parameter tool, this is nearly complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% (target_id well documented). The description repeats the context of the parameter (returned by scanner_register_target) but adds no new semantics beyond verifying ownership via DNS/.well-known.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action (verify domain ownership) and the resource (target), with specific method (DNS TXT/.well-known check). It distinguishes from sibling tools like scanner_register_target (registration) and scanner_start_scan (scanning).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It implies usage after registration ('previously registered target') but does not explicitly state when to use vs alternatives, nor provide conditions for not using this tool. No alternative tools mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
v0.1.1scanner_get_findingsscanner_get_scan_statusscanner_register_targetscanner_start_scanscanner_verify_targetScored across 5 tools
Each tool targets a distinct step in the scanning workflow: registration, verification, scan start, status polling, and findings retrieval. No two tools overlap in purpose, making selection unambiguous.
All tools follow a consistent 'scanner_verb_noun' pattern with snake_case (e.g., scanner_get_findings, scanner_register_target). The prefix and structure are uniform across all five tools.
With 5 tools, the server is well-scoped for its purpose—managing security scans. Each tool addresses a necessary step, and the count is neither too thin nor overly heavy for the domain.
The tool set covers the full scan lifecycle: register, verify, start, poll status, and retrieve findings. Minor gaps like a tool to delete or list targets exist but do not hinder the primary workflow.
Domain intel for AI agents: RDAP registration, DNS, email deliverability, tech stack.
Domain intel for AI agents: RDAP registration, DNS, email deliverability, tech stack.
Score any website's AI-agent readiness. Open Agent Registry scanner + platform tools.
Domain registration for AI agents via Stripe or x402 crypto with Cloudflare DNS.