scan.okxo.de
Check an OpenCloud instance for known vulnerabilities, missing hardening, weak security headers and available updates. Free to use, with no account required.
First seen 2026-11-05 · Last seen 2026-11-05 · Source: webmcp.com
Answer 1 · Act 2 · Transact 0 · Score: Not yet scored
Tool inspector
scan_opencloud_security
Queue a security scan for a publicly reachable OpenCloud instance. Submitting is all this does: it answers with a uuid, the state 'queued' and the url of the result page. The rating does not exist yet. Scanning is asynchronous. Submission answers 202 Accepted with a uuid and the state 'queued'; the rating does not exist yet. Poll GET /api/scans/{uuid} every 3 seconds until the response carries 'done': true, which happens when the state reaches 'completed' or 'failed'. Allow up to about 5 minutes. This page registers no tool that reads a result - browser tools belong to the page they are on. Open the returned url; the result page registers get_scan_result and export_scan_report for that scan. A request chooses what to scan, never how hard. target_url, ignore_hardenings, release_track and output_format are the only accepted fields; anything else answers 422 naming the field. Concurrency, timeouts and TLS verification are server-side settings with no request-side equivalent. 429 is not a refusal. A client limit and a per-target cooldown both answer 429 with Retry-After in seconds; wait that long and try again, at most 3 times. A Retry-After longer than 300 seconds is a daily cap or a block for scanning hosts that were not OpenCloud: do not wait it out, tell the user. 403 means the deployment scans approved instances only. The whole scanner is open source and runs locally with no limits at all: https://github.com/sowoi/check-opencloud-security The uuid is the whole of the authorisation. Whoever has it can read that scan and nobody else can, there is no endpoint that lists scans, and an unknown, malformed or expired uuid all answer 404 alike. Treat it as a secret, do not guess one, and do not retry a 404 - the result is gone. This tool does not throw. A failure comes back as ok: false with status, error and retryable, plus retryAfter in seconds where the server sent one. retryable false means stop and report the error; do not call the tool again.
Page: /
Input schema
| Property | Type | Required | Description |
|---|---|---|---|
ignore_hardenings |
array | no | Hardening identifiers to waive. A waived finding is still reported; it just stops capping the rating. |
output_format |
string | no | What the result page renders for the visitor. |
release_track |
string | no | How the version is judged. Changes the rating's reasoning and nothing about the scan itself. |
target_url |
string | yes | Public OpenCloud base URL or hostname. It must resolve publicly; a private, loopback or link-local address is refused and retrying will not help. |
Raw JSON schema
{
"additionalProperties": false,
"properties": {
"ignore_hardenings": {
"default": [],
"description": "Hardening identifiers to waive. A waived finding is still reported; it just stops capping the rating.",
"items": {
"enum": [
"basicAuthDisabled",
"cspWithoutUnsafeInline",
"publicLinkPasswordEnforced",
"passwordPolicyEnforced",
"passwordPolicyComplexity",
"hstsLongMaxAge",
"hstsPreload",
"httpsEnforced",
"identityProviderDetected",
"oidcPkceSupported",
"oidcImplicitFlowDisabled",
"oidcSigningAlgorithmStrong",
"oidcEndpointsUseHttps",
"reverseProxyDetected",
"Strict-Transport-Security",
"Content-Security-Policy",
"X-Content-Type-Options",
"X-Frame-Options",
"X-Permitted-Cross-Domain-Policies",
"X-Robots-Tag",
"X-XSS-Protection",
"Referrer-Policy",
"tlsTrusted",
"tlsProtocol",
"tlsDeprecatedProtocol",
"tlsCertificate",
"tlsCertificateLifetime",
"tlsCipherSuite",
"tlsCertificatePolicy",
"tlsAddressParity",
"cookieSecure",
"cookieHttpOnly",
"cookieSameSite",
"cookiePrefix",
"tlsChain",
"tlsOcspStapling",
"tlsCertificateTransparency",
"tlsEarlyData",
"corsOriginRestricted",
"traceMethodDisabled",
"versionDisclosure:Server",
"versionDisclosure:X-Powered-By",
"webfingerVersionDisclosure",
"directoryListing"
],
"type": "string"
},
"type": "array",
"uniqueItems": true
},
"output_format": {
"default": "dashboard",
"description": "What the result page renders for the visitor.",
"enum": [
"dashboard",
"json",
"csv",
"sarif",
"pdf"
],
"type": "string"
},
"release_track": {
"default": "auto",
"description": "How the version is judged. Changes the rating's reasoning and nothing about the scan itself.",
"enum": [
"auto",
"rolling",
"production",
"lts"
],
"type": "string"
},
"target_url": {
"description": "Public OpenCloud base URL or hostname. It must resolve publicly; a private, loopback or link-local address is refused and retrying will not help.",
"type": "string"
}
},
"required": [
"target_url"
],
"type": "object"
}
Similar websites
morphus.myles4miles.chatgpt.site
Morphus is an AI-native workspace for designing worlds and generating playable game experiences.
damnpdfs.com
Install the DamnPDFs Codex plugin, pair a browser workspace and use PDF, image and file tools from your coding agent. Includes setup and privacy limits.
insignifi4nt.github.io
broCAD/M: local-first CAD and CAM for parametric design, wire EDM planning, simulation and controller export.
cabinet.varera.studio
The Cartographer's Cabinet