Run a web vulnerability scan against a target URL. Crawls the site (same-origin, skips logout/asset links) and runs modules by profile: 'passive' sends no payloads (headers, SSL/TLS, DNS, cookies, WAF, fingerprint, JWT, CSP, SRI, security.txt); 'balanced' (default) adds safe active checks (XSS, SQLi, CORS, open-redirect, SSTI, host-header); 'aggressive' is the same modules at higher rate/concurrency. Returns findings grouped with severity, CWE, OWASP category, confidence and remediation. Time-boxed by max_minutes (default 20; partial results are kept). use_ct_logs=true also asks Certificate Transparency logs (crt.sh) for subdomains (sends the domain to a third party — only with the user's consent); allow_external=false skips modules that contact hosts other than the target. seed_urls adds same-origin pages no link points to; headers/cookies make it an authenticated scan (use a test account, never a real user's session). Only scan targets the user owns or is authorized to test; pass authorized=true only after they confirm.

Fast passive check of a single URL — no payloads sent. Runs security headers, SSL/TLS, cookies, clickjacking, CSP review, SRI, WAF/CDN detection, technology fingerprint, DNS (SPF/DMARC), HTTP methods, security.txt, and JWT analysis. Safe for a first look. Pass authorized=true after the user confirms authorization.

Detect whether a target sits behind a Web Application Firewall or CDN (Cloudflare, AWS WAF, Akamai, Imperva, Sucuri, F5, ModSecurity, Fastly, …). Passive, single request. Pass authorized=true after the user confirms.

Get a formatted report for a completed scan. format: 'md' (default, OWASP-grouped), 'json', 'html' (self-contained), 'sarif' (for CI/code-scanning), 'csv', or 'fix-nginx' / 'fix-apache' / 'fix-caddy' / 'fix-express' / 'fix-dns'.

List recent scans with IDs, targets, status, risk grade and finding counts. Optionally filter by target host substring.

Compare two scans by scan_id (e.g. before vs after a fix). Reports which findings were resolved, which are new, which persist, the risk-score delta and an improved/regressed verdict. Triaged-away findings are excluded, so false positives don't skew the diff.

Show the risk-score trend for a host across its scan history (oldest first) — useful for reporting whether a site's posture is improving over time.

Record a triage decision for a finding so it persists across future scans of the same host. status: 'confirmed', 'false_positive', 'accepted_risk', 'fixed', or 'open' (clears it). false_positive / accepted_risk / fixed are excluded from the risk score. Identify the finding by its id or fingerprint from a scan result.

Turn a scan's findings into paste-ready remediation for one platform: 'nginx', 'apache', 'caddy', 'express' (helmet/cookies) or 'dns' (SPF/DMARC/CAA records, dangling-record removal). Only issues actually found produce a snippet; CSP is emitted report-only. Show the user the snippets and remind them to test on staging.

Get the HTTP statistics of a scan (requests, cache hits, coalesced requests, retries, errors, status-code breakdown, average latency).

List all FSV scan modules with their category (passive/active), scope (site/url) and what each checks, plus the available scan profiles.

Prove control of a host so payload-sending scans are allowed on deployments that require it (FSV_REQUIRE_VERIFICATION=1). check=false returns the DNS TXT record / HTTP file to publish; check=true looks for it and records the proof.