{"api_version":"2026-09-12","product":"Vibe Check Scan","site_url":"https://vibecheckscan.com","auth_required":false,"auth_discovery":{"published":false,"reason":"OAuth/OIDC discovery endpoints are intentionally not published because the public scan API does not currently require tokens."},"protocols":{"rest":true,"mcp":false,"mcp_note":"No MCP server is published for this service and none is planned. /.well-known/mcp/server-card.json returns 410. Use the REST API described by the OpenAPI document.","webmcp_in_page":true,"cors":"Cross-origin browser reads are not enabled in production. Use same-origin calls or server-to-server REST requests."},"discovery_resources":{"api_catalog":"https://vibecheckscan.com/.well-known/api-catalog","agent_skills_index":"https://vibecheckscan.com/.well-known/agent-skills/index.json","openapi":"https://vibecheckscan.com/api/openapi.json","agent_card":"https://vibecheckscan.com/api/agent/card","interpret":"https://vibecheckscan.com/api/agent/interpret","llms_txt":"https://vibecheckscan.com/llms.txt","health":"https://vibecheckscan.com/api/health"},"rate_limits":{"scanEndpoints":"5 requests per IP per minute (POST /api/scan/start, POST /api/cve-2025-55182/check)","pageRoutes":"100 requests per IP per minute (HTML page routes; API routes under /api/ are not subject to this limit)","polling":"Status polling is not rate limited. Poll every 2-3 seconds; do not poll faster.","onLimit":"429 with Retry-After header (seconds) and code: \"rate_limit_exceeded\""},"scan_modules":[{"name":"headers","label":"Security Headers","weight":"26.25%","description":"CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy. Each finding reports presence separately from assessment, so \"absent\" is distinguished from \"misconfigured\"."},{"name":"tls","label":"TLS/SSL","weight":"22.5%","description":"Protocol version, certificate expiry, trust chain, cipher strength."},{"name":"cors","label":"CORS Policy","weight":"15%","description":"Wildcard origins, credentials policy, localhost/null origin exposure."},{"name":"apiSurface","label":"API Surface","weight":"11.25%","description":"Classifies probed paths into confirmedExposure, needsReview, protectedSurface, expectedPublicEndpoint and hardeningOpportunity. Server-secret material and exposed .env files are confirmedExposure. Public client config is informational. Only confirmedExposure findings affect the score."},{"name":"cve","label":"React / Next CVEs","weight":"25%","weight_note":"confirmed matches only","description":"Passively detects React Server Components and the React version, then checks that version against the OSV.dev advisory database for react-server-dom-* packages. No vulnerable-version list is maintained server-side. Only a confirmed advisory match (status confirmed_vulnerable) affects the grade; not_vulnerable and uncertain are informational and excluded from the weighted average."}],"capabilities":[{"name":"start_scan","description":"Start an asynchronous security scan of a public URL. Returns a scanId immediately. Use poll_scan_status to track progress; the terminal poll carries the result inline.","implementation_status":"implemented","auth_required":false,"exposed_via":["rest"],"endpoint":{"method":"POST","path":"/api/scan/start"},"input_schema":{"type":"object","required":["url"],"properties":{"url":{"type":"string","format":"uri","description":"Fully-qualified public URL to scan (http or https). Private/internal addresses are blocked.","example":"https://example.com"}}},"output_schema":{"type":"object","properties":{"scanId":{"type":"string","description":"32-char hex scan identifier."},"queued":{"type":"boolean","description":"True if queued due to concurrency limits."}}}},{"name":"poll_scan_status","description":"Poll the progress of a running scan. Each module reports its own status. The scan is complete when the top-level status becomes \"completed\" or \"error\". Terminal responses include the result inline.","implementation_status":"implemented","auth_required":false,"exposed_via":["rest"],"endpoint":{"method":"GET","path":"/api/scan/status"},"input_schema":{"type":"object","required":["id"],"properties":{"id":{"type":"string","description":"The scanId returned by start_scan."},"format":{"type":"string","enum":["full","summary","agent"],"default":"full","description":"\"agent\" includes a message-ready result payload when the scan has finished."}}},"output_schema":{"type":"object","properties":{"status":{"type":"string","enum":["queued","running","completed","error"]},"scanId":{"type":"string"},"url":{"type":"string"},"timestamp":{"type":"number"},"modules":{"type":"object","additionalProperties":{"type":"object","properties":{"status":{"type":"string","enum":["pending","running","done","error"]}}}},"result":{"type":"object","description":"Present on terminal responses. Shape depends on requested format."}}},"polling_guidance":"Poll every 2-3 seconds. Prefer format=agent and stop when the top-level status becomes \"completed\" or \"error\". A 404 with code \"scan_not_found\" and \"retryable\": true means the poll reached an instance that does not hold this scan — retry a few times before giving up."},{"name":"get_scan_result","description":"Retrieve the completed scan report. Includes overall grade (A-F), score, and per-module findings. Results expire after 24 hours.","implementation_status":"implemented","auth_required":false,"exposed_via":["rest"],"endpoint":{"method":"GET","path":"/api/scan/result"},"input_schema":{"type":"object","required":["id"],"properties":{"id":{"type":"string","description":"The scanId returned by start_scan."},"format":{"type":"string","enum":["full","summary","agent","text","markdown","telegram","whatsapp","fix","remediation"],"default":"full","description":"\"full\": Complete scan report with all findings. The default. \"summary\": Condensed JSON with scores and counts only. \"agent\": JSON containing text, markdown, remediationBrief and summary. \"text\": Plain text for chat delivery. \"markdown\": Markdown for chat delivery. \"telegram\": Alias of markdown. \"whatsapp\": Alias of markdown. \"fix\": Markdown task list for a coding agent to investigate and fix the findings. Evidence is redacted. \"remediation\": Alias of fix."}}}},{"name":"check_rsc_vulnerability","description":"Passively detect React Server Components and the React version on a URL, then check that version against the OSV.dev advisory database (react-server-dom-* packages, e.g. CVE-2025-55182). GET requests only; no version data is hard-coded server-side. Returns status not_vulnerable | uncertain | confirmed_vulnerable and any matching advisories.","implementation_status":"implemented","auth_required":false,"exposed_via":["rest"],"endpoint":{"method":"POST","path":"/api/cve-2025-55182/check"},"input_schema":{"type":"object","required":["url"],"properties":{"url":{"type":"string","format":"uri","description":"Fully-qualified public URL to check.","example":"https://example.com"}}}}]}