urlscan-search

v0.1.0Verified publisher

Searches urlscan.io's existing scans of a domain, IP or URL: each page's title, server, IP, network and country

Run

TerminalAgent

Through ot mcp, an agent calls run_tool with this; ot asks you before anything that goes online or touches a target. Set it up: ot mcp install claude (or cursor, vscode, codex, gemini).

{"tool":"osintverse-community/urlscan-search"}

Or just say: "Run osintverse-community/urlscan-search on … with OTInstaller." The registry's read-only MCP server at api.otinstaller.com/mcp can find tools without installing anything.

ot run osintverse-community/urlscan-search --format table

ot install osintverse-community/urlscan-search

Docker image in a read-only container · talks to urlscan.io · no key · up to 2 min. The first ot run installs the tool after asking once. Drop --format table for JSON.

Don't have ot? Install it in one line

macOS / LinuxWindows

curl -fsSL https://get.otinstaller.com/ot | sh

What this script does

Downloads the latest ot release for your machine from GitHub Releases.
Checks its SHA-256 against checksums.txt, and the Ed25519 signature on that file against the key built into the script.
Puts ot in /usr/local/bin or ~/.local/bin. Nothing else is written. Read the script.

irm https://get.otinstaller.com/ot.ps1 | iex

What this script does

Downloads the latest ot release for your machine from GitHub Releases.
Checks its SHA-256 against checksums.txt, and the Ed25519 signature on that file against the key built into the script.
Puts ot in %LOCALAPPDATA%\Programs\ot, and adds it to your PATH. Nothing else is written. Read the script.

Evidence

Security tab →

Pinnedimage sha256:96add51d…545de9. The same bytes on every install; ot pulls by digest, never by tag.
Signedby https://github.com/osintverse-community/urlscan-search/.github/workflows/otinstaller-release.yml@refs/heads/main via token.actions.githubusercontent.com, verified by the registry on 24 Oct 2026. ot checks the same identity before every install and refuses another signer.
Scanned24 Oct 2026: 0 critical, 44 high, 63 medium, 62 low vulnerabilities; 0 embedded secrets, 0 malware heuristics; SBOM with 97 packages.
Workssmoke test passed on 24 Oct 2026 (exit 0 in 3.8 s, offline sandbox); the nightly health check has not run yet.
Backed upa copy of this image is on the registry's mirror. If the original registry refuses it, ot pulls the same digest from the mirror and checks the same signature.
Reviewedosintverse-community is a verified publisher: the registry confirmed who runs it, and a person reviewed its first release against the acceptable-use rules.

From the community

Issues →

Not health-checked yet; 0.1.0 came out today; nobody has said yet whether it works.

0.1.0 is in its first week. Nobody has said whether it works yet.

Used 0.1.0?It's broken for me

What you get back

Result envelope →

{
  "envelope": 1,
  "tool": "osintverse-community/urlscan-search@0.1.0",
  "runtime": "docker",
  "input": {
    "domain": "example.com",
    "limit": "10"
  },
  "started_at": "2026-10-24T16:59:54Z",
  "exit_code": 0,
  "entities": [
    {
      "type": "url",
      "value": "https://example.com/"
    },
    {
      "type": "url",
      "value": "https://example.com/"
    },
    {
      "type": "url",
      "value": "https://example.com/"
    },
    {
      "type": "url",
      "value": "https://example.com/"
    },
    {
      "type": "url",
      "value": "https://example.com/"
    }
    … 9 more
  ],
  "warnings": []
}

Recorded from the registry's own run of version 0.1.0 on its test input, 24 Oct 2026. --format table to read it; ot extract and ot auto to continue.

urlscan-search

Searches urlscan.io for the scans other people already made of a domain, an IP address or a URL, or runs any urlscan.io search query. Each scanned page comes back with its address, title, HTTP status, server, IP address, network, country and TLS issuer, when it was scanned and what was submitted, with links to the scan and its screenshot; the IP addresses and host names seen are listed too. Uses urlscan.io's official Python client, urlscan-python. It never submits a new scan, so the target is not contacted.

ot run osintverse-community/urlscan-search --domain example.com

Inputs

Give exactly one of domain, ip, url or query.

Input	Required
`domain`	one of these	Scans of pages on this host name (`page.domain`)
`ip`	one of these	Scans of pages served from this IP address (`page.ip`)
`url`	one of these	Scans of this exact page (`page.url`)
`query`	one of these	Any urlscan.io search query, such as `page.asn:AS15169` or `domain:example.com` (pages that loaded anything from it)
`limit`	no	Most scans to return, 50 by default, up to 1000

Keys

None needed: searches work anonymously at lower rate limits. URLSCAN_API_KEY (ot keys set URLSCAN_API_KEY), from a free urlscan.io account, raises them: https://urlscan.io/user/profile/.

Notes

Only public scans are searched. The newest scans come first. A rate-limited search exits with code 1 and says so on stderr.

Next steps

Look a scanned page's IP address up with osintverse-community/virustotal, or check the URL against osintverse-community/phishtank-lookup.

Development

pip install urlscan-python==2026.8.18
python -m unittest
ot validate

Releases are built, signed and published by the otinstaller release workflow (Actions tab, with the version to release).

License

MIT

What next

urlscan-search finds url, ip, domain, subdomain. Tools that take those:

url → 10 tools ip → 10 tools domain → 10 tools subdomain → 10 tools ot auto, with a saved result

Other domain tools

All domain tools →

Alternatives to urlscan-search that also take a domain; ot auto runs every installed one on the same value.