Open agent skill · MIT license

Security checks, inside your agent.

Review a web project in your own workspace, or check a deployed site through SiteXray. One open skill, two ways to find what needs attention.

Connect MCP View on GitHub Read SKILL.md

Install the skill

Run this in your project and choose your coding agent. The repository contains a standard Agent Skill for Codex, Claude Code, Cursor and other compatible agents.

npx skills add littleben/sitexray --skill sitexray

The installer needs Node.js 22.20 or later. The optional scan helper uses Python 3.9+ and its standard library. No account or API key is needed for hosted scans.

Review your source code

The agent inspects authentication, access controls, secret exposure, unsafe inputs and deployment settings using the code already in its workspace. It does not send source code to SiteXray; findings include file locations and practical fixes.

Use $sitexray to review this web project for security issues. Show confirmed findings, affected files and the smallest useful fixes.

Scan your live website

The agent calls SiteXray to check TLS, security headers, cookies, exposed files, public secrets and software banners. The response includes a score, findings and a shareable report link when saved.

Use $sitexray to scan https://your-site.example. I own this website. Explain the findings and give me the report link.

Connect with remote MCP

Add this URL to an agent that supports Streamable HTTP MCP. It calls the same website scan service directly. No local server, account or API key is required.

https://sitexray.net/mcp

For clients using the mcpServers JSON format with HTTP transport (such as Claude Code), add this configuration. Other clients may ask only for the URL and transport type.

{
  "mcpServers": {
    "sitexray": {
      "type": "http",
      "url": "https://sitexray.net/mcp"
    }
  }
}

scan_website — Scan an authorized public website. Pass url, authorized: true and optional locale (en or zh). Returns findings, score and a shareable reportUrl.

get_report — Read a saved report with reportId and optional locale, without scanning the target again.

{ "url": "https://your-site.example", "authorized": true, "locale": "en" }

Allow up to 90 seconds for a scan. MCP shares the API scan limit of one call per eight seconds per client. Tool errors include retryAfterSeconds when rate limited. Hosted scans create unlisted, noindex reports that anyone with the link can read. Use authorization already established by the task.

Call the website directly

Agents with HTTP tools can use the scan API without installing anything. Replace the example URL with a website you own or are authorized to test. Set authorized to true only when that permission is established.

curl --max-time 90 https://sitexray.net/api/scan \
  -H 'Content-Type: application/json' \
  --data '{"url":"https://your-site.example","authorized":true}'

A successful response has code: 0 and a data object with the grade, score, findings and scan time. When data.id is present, open https://sitexray.net/report/REPORT_ID for the saved report. The full skill documents the response and errors.

Allow up to 90 seconds. Calls are limited to one per eight seconds per client; recent scans of the same host may be reused for about five minutes. Respect HTTP 429 and Retry-After.

What each mode can tell you

Local review does not send your source code to SiteXray. Hosted scanning sends the target URL and saves an unlisted report that anyone with its link can read; report pages use noindex. Passive checks do not test code behind a login or prove a site is secure.

Try the website scanner