urlscan.io
First-partySubmit URLs for scanning and search urlscan.io's dataset of scanned pages (verdicts, redirects, resources, screenshots).
3 actions First-party pack
Request access
Connect urlscan.io once you're in Boring.
01 · WHAT THE AGENT CAN DO
Actions
Every capability is a discrete, logged action the agent calls by name — scoped to what you authorize and recorded in the run trace.
Submit a URL for scanningcustom_urlscan_submit_scan
Submit a URL to urlscan.io for a fresh scan. Returns a scan `uuid` and a `result` API URL to poll with get_result (results take ~10s and 404 until ready). VISIBILITY: defaults to `private` — the only truly private level. `unlisted` is hidden from public search but still visible to vetted security companies; `public` is fully public. NEVER submit URLs containing secrets, session tokens, magic-link credentials, or internal hostnames, and strip PII from URLs before scanning. This is a write action and pauses for human approval by default.
Get a scan resultcustom_urlscan_get_result
Fetch the full result of a completed scan by its `uuid` (from submit_scan). Returns verdicts, page/redirect data, resources, and a screenshot URL. A 404 means the scan is still running — wait a few seconds and retry.
Search scanned pagescustom_urlscan_search
Search urlscan.io's dataset of previously scanned pages with a query (e.g. `domain:example.com`, `page.url:...`, `ip:...`, `hash:...`). Returns matching scans. This reads the public dataset — do not use it to bulk-mirror or scrape results. Attribute results to urlscan.io.