Developer Tools & Devops · urlscan.io + Claude
urlscan.io MCP with Claude: Faster Website Threat Investigation for Security Teams
The short answer
Claude connects to urlscan.io through the Model Context Protocol, an open standard that lets Claude securely use other software. Once connected, Claude can submit website scans, retrieve scan results and search urlscan.io's threat data using natural language, with permissions set by your organisation.
What is urlscan.io?
urlscan.io is a website scanning and threat intelligence platform. It analyses URLs, domains, IP addresses and web behaviour, showing what a page loads, where it connects and how it behaves. Security teams use it to investigate suspicious sites, detect phishing campaigns and search rich scan data quickly. Developers and DevOps teams also use it to check links and domains as part of their wider security work.
How Claude connects to urlscan.io through MCP
The Model Context Protocol, or MCP, is an open standard that acts as a universal adapter between Claude and other software. It lets Claude read information from a tool and take actions in it, using access the organisation controls. For urlscan.io, the connection can use the platform's official MCP server or a direct API link, signed in with an API key.
Once connected, Claude can typically submit a URL for scanning, retrieve the results of earlier scans, and search threat data by domain, IP address or page characteristics. An analyst can ask, in plain English, for every recent scan that matches a suspicious pattern, and Claude returns a clear summary of what it found.
Permissions and approvals keep people in charge. Access can be limited to read-only searches or extended to submitting scans, depending on the role. Consequential actions can require a person's sign-off, and every request is logged so the security team can review what was done and why.
What you can automate
Triaging suspicious links reported by staff
When employees forward a suspicious e-mail or link, Claude can submit the URL to urlscan.io and summarise the results. The analyst sees whether the page redirects, hides a login form or contacts unfamiliar domains, and decides quickly whether to block it. This shortens the time between a report and a decision.
Investigating phishing campaigns
Security analysts often need to find every site linked to one campaign. Claude can search urlscan.io's scan data for shared domains, IP addresses or page elements, then group the related results. This helps the team map the full extent of an attack instead of checking one site at a time.
Monitoring brand impersonation
Marketing and legal teams can ask Claude to check for lookalike domains or copies of the company's pages. Claude can run scheduled searches and report new matches, giving the brand team early warning of fake sites that could mislead customers.
Supporting incident response
During an incident, responders need answers fast. Claude can retrieve scan histories for affected domains and summarise what they show, such as malicious scripts or new hosting locations. The response team keeps control of the decisions and uses Claude to speed up the evidence gathering.
Reporting for leadership and compliance
Security leads often need a plain-language summary of threats for executives or auditors. Claude can pull the relevant scan data and draft a short report covering volumes, patterns and actions taken, which the security lead reviews before sharing.
An end-to-end workflow: Phishing report triage to ticket
TriggerAn employee forwards a suspicious e-mail to the security mailbox
Claude extracts the links from the e-mail and checks them against recent urlscan.io results.
Claude submits any unscanned URLs to urlscan.io and retrieves the completed results.
Claude summarises redirects, login forms and contacted domains for each link.
If a link is confirmed as malicious, Claude drafts a block request and a ticket in the IT service desk system.
An analyst reviews the summary and approves the block before it takes effect.
The outcome is logged in the ticketing system for the audit trail.
OutcomeTypically, reported links are assessed in minutes rather than hours, with a clear record of each decision for audit purposes.
How we set it up
Free automation audit
We review your security and operations workflows to find where website scanning and threat searching slow your team down. You receive a clear list of the workflows worth automating, at no cost.
Secure connection
We connect Claude to urlscan.io using the official MCP server or a direct API link, signed in with your API key. The key is stored securely and access is limited to the permissions your team needs.
Workflow design
We design the end-to-end workflow across urlscan.io and your other systems, such as Microsoft 365, your ticketing platform and your CRM. Approval points are set for any action that affects users or systems.
Testing and launch
We test the workflow against real past cases from your own investigations, then launch with monitoring and audit logs turned on so every action can be reviewed.
Team training
We train analysts, IT staff and managers on how to use Claude with urlscan.io, what to approve and how to check results, so your team stays confident and in control after launch.
Who benefits
- Security analysts
- Faster triage of suspicious links and quicker searches across scan history.
- Security and IT managers
- Clear audit trails and controlled access for each team member.
- Incident responders
- Rapid evidence gathering during time-critical investigations.
- Brand and legal teams
- Early warning of impersonation sites that could mislead customers.
Security and control
- Use an API key with the least privilege needed for each role, and rotate it on a regular schedule.
- Require human approval before any block, takedown or other consequential action.
- Keep audit logs of every scan submitted and every search run through Claude.
- Restrict which data Claude can share outside the security team.
- Review Claude's summaries against the raw scan results before acting on them.
For teams in the US, UK, India and the Middle East
Organisations in the United States and the United Kingdom can host the Claude workflow in their chosen region to meet their data handling requirements. In India, the Digital Personal Data Protection Act, 2023 governs personal data, and hosting in India supports those obligations. Organisations in the UAE and Saudi Arabia must meet local data protection laws, and we select the hosting region with those requirements in mind. Hosting is chosen to meet your requirements, and we confirm the approach with your legal or compliance team before launch.
Learn more about Claude and MCP
Anthropic's AI model and assistant.
Secure links between Claude and business tools.
How engineers build and change software with Claude.
Hosted agents that run multi-step work.
The open standard Claude uses to connect to tools.
Frequently asked questions
What does the urlscan.io MCP server do?
The urlscan.io MCP server lets Claude and other AI tools use urlscan.io safely. Through it, Claude can submit website scans, retrieve scan results and search threat data using natural language. It acts as a secure bridge, so the AI works within the permissions you set rather than having open access to the platform.
Is connecting urlscan.io to Claude secure?
The connection is designed for secure use. It uses your API key, access can be limited to the actions each role needs, and every request can be logged. Consequential actions can require human approval. We review the setup with your security team before launch to confirm it meets your standards.
What can Claude do with urlscan.io once connected?
Typically, Claude can submit URLs for scanning, retrieve results from earlier scans, search threat data by domain, IP address or page features, and help manage urlscan.io Pro resources. It then summarises the findings in plain English, so analysts can act faster.
How long does setup take?
Setup time depends on how many workflows you want to connect and how many systems are involved. A focused single workflow is often launched within a few weeks, including testing and training. We confirm the timeline during your free automation audit.
Which plan or permissions do I need for urlscan.io?
Generally, you need an urlscan.io account with an API key, and the level of access depends on the features your team uses. Some capabilities may depend on your urlscan.io plan. We check your account and permissions during the audit so the workflow matches what you already have.