---
title: Vibe Check Scan Developer Docs
description: API and agent documentation for the Vibe Check Scan service.
---

# Developer Docs

Vibe Check Scan exposes a public REST API for passive security scans. No API key needed.

## Endpoints

- `POST /api/scan/start` starts an asynchronous scan for a public URL
- `GET /api/scan/status?id={scanId}` polls progress and returns the final result inline
- `GET /api/scan/result?id={scanId}` fetches the completed report
- `POST /api/cve-2025-55182/check` detects React Server Components + React version and
  checks it against the OSV.dev advisory database
- `GET /api/agent/capabilities` capability registry with JSON schemas
- `GET /api/agent/card` agent card
- `GET /api/agent/skill` optional skill file
- `GET /api/agent/interpret` result interpretation guide
- `GET /api/openapi.json` returns the OpenAPI 3.1 description
- `GET /api/health` returns a lightweight service health document

## Result formats

- GET https://vibecheckscan.com/api/scan/result?id={scanId} — Complete scan report with all findings. The default.
- GET https://vibecheckscan.com/api/scan/result?id={scanId}&format=summary — Condensed JSON with scores and counts only.
- GET https://vibecheckscan.com/api/scan/result?id={scanId}&format=agent — JSON containing text, markdown, remediationBrief and summary.
- GET https://vibecheckscan.com/api/scan/result?id={scanId}&format=text — Plain text for chat delivery.
- GET https://vibecheckscan.com/api/scan/result?id={scanId}&format=markdown — Markdown for chat delivery.
- GET https://vibecheckscan.com/api/scan/result?id={scanId}&format=telegram — Alias of markdown. (alias of markdown)
- GET https://vibecheckscan.com/api/scan/result?id={scanId}&format=whatsapp — Alias of markdown. (alias of markdown)
- GET https://vibecheckscan.com/api/scan/result?id={scanId}&format=fix — Markdown task list for a coding agent to investigate and fix the findings. Evidence is redacted.
- GET https://vibecheckscan.com/api/scan/result?id={scanId}&format=remediation — Alias of fix. (alias of fix)

## Module weights

| Module | Weight | What drives the score down |
|--------|--------|---------------------------|
| headers | 26.25% | Missing CSP, HSTS, and X-Content-Type-Options hurt most. Missing X-Frame-Options or Permissions-Policy is usually a lighter hardening gap unless the app handles sensitive user actions. |
| tls | 22.5% | Weak protocol (TLS 1.0/1.1), expiring certificate, untrusted chain, weak ciphers. |
| cors | 15% | Wildcard origin, credentials with wildcard, localhost or null origin allowed. |
| apiSurface | 11.25% | Confirmed exposures only — publicly readable sensitive files, leaked server-secret material, unprotected business-data endpoints, accessible source maps. |
| cve | 25% (confirmed matches only) | React Server Components detected plus an exact React version that OSV.dev reports advisories for (status confirmed_vulnerable) scores 0 and blocks an A. Status uncertain (version unresolved or OSV unreachable) and not_vulnerable do not affect the grade — check the affectsGrade flag. |

## Rate limits

- 5 requests per IP per minute (POST /api/scan/start, POST /api/cve-2025-55182/check)
- 100 requests per IP per minute (HTML page routes; API routes under /api/ are not subject to this limit)
- Status polling is not rate limited. Poll every 2-3 seconds; do not poll faster.
- 429 with Retry-After header (seconds) and code: "rate_limit_exceeded"

## Result retention

24 hours — scan results and share links are deleted after 24 hours

## Markdown representations

- https://vibecheckscan.com/index.md
- https://vibecheckscan.com/developers.md
- https://vibecheckscan.com/cve-2025-55182-check.md
- https://vibecheckscan.com/scan/{scanId}/report.md

## Discovery resources

- API catalog: https://vibecheckscan.com/.well-known/api-catalog
- Agent skills: https://vibecheckscan.com/.well-known/agent-skills/index.json
- Overview: https://vibecheckscan.com/llms.txt

## Authentication

- The API is public and does not currently require OAuth or OIDC tokens.
- OAuth/OIDC well-known metadata is intentionally omitted until the service has real
  protected routes and an issuer.

## Protocol support

- REST over HTTPS, described by `GET /api/openapi.json`.
- Cross-origin requests are allowed on `/api/` and the discovery documents, so
  browser-resident agents can call the API directly.
- An experimental in-page WebMCP tool provider (`navigator.modelContext`) is registered
  on the site for browser agents that support it.
- There is no MCP server and none is planned. Do not look for an MCP endpoint.