scan.okxo.de

{
  "name": "search_site",
  "kind": "act",
  "impl": "declarative",
  "description": "Search through documentation and security guides.",
  "inputSchema": {
    "type": "object",
    "properties": {
      "q": {
        "type": "string",
        "description": "Search"
      }
    }
  },
  "page": "/"
}

{
  "name": "scan_opencloud_security",
  "kind": "act",
  "impl": "imperative",
  "description": "Queue a security scan for a publicly reachable OpenCloud instance. Submitting is all this does: it answers with a uuid, the state 'queued' and the url of the result page. The rating does not exist yet.\n\nScanning is asynchronous. Submission answers 202 Accepted with a uuid and the state 'queued'; the rating does not exist yet. Poll GET /api/scans/{uuid} every 3 seconds until the response carries 'done': true, which happens when the state reaches 'completed' or 'failed'. Allow up to about 5 minutes.\n\nThis page registers no tool that reads a result - browser tools belong to the page they are on. Open the returned url; the result page registers get_scan_result and export_scan_report for that scan.\n\nA request chooses what to scan, never how hard. target_url, ignore_hardenings, release_track and output_format are the only accepted fields; anything else answers 422 naming the field. Concurrency, timeouts and TLS verification are server-side settings with no request-side equivalent.\n\n429 is not a refusal. A client limit and a per-target cooldown both answer 429 with Retry-After in seconds; wait that long and try again, at most 3 times. A Retry-After longer than 300 seconds is a daily cap or a block for scanning hosts that were not OpenCloud: do not wait it out, tell the user. 403 means the deployment scans approved instances only. The whole scanner is open source and runs locally with no limits at all: https://github.com/sowoi/check-opencloud-security\n\nThe uuid is the whole of the authorisation. Whoever has it can read that scan and nobody else can, there is no endpoint that lists scans, and an unknown, malformed or expired uuid all answer 404 alike. Treat it as a secret, do not guess one, and do not retry a 404 - the result is gone.\n\nThis tool does not throw. A failure comes back as ok: false with status, error and retryable, plus retryAfter in seconds where the server sent one. retryable false means stop and report the error; do not call the tool again.",
  "inputSchema": {
    "additionalProperties": false,
    "properties": {
      "ignore_hardenings": {
        "default": [],
        "description": "Hardening identifiers to waive. A waived finding is still reported; it just stops capping the rating.",
        "items": {
          "enum": [
            "basicAuthDisabled",
            "cspWithoutUnsafeInline",
            "publicLinkPasswordEnforced",
            "passwordPolicyEnforced",
            "passwordPolicyComplexity",
            "hstsLongMaxAge",
            "hstsPreload",
            "httpsEnforced",
            "identityProviderDetected",
            "oidcPkceSupported",
            "oidcImplicitFlowDisabled",
            "oidcSigningAlgorithmStrong",
            "oidcEndpointsUseHttps",
            "reverseProxyDetected",
            "Strict-Transport-Security",
            "Content-Security-Policy",
            "X-Content-Type-Options",
            "X-Frame-Options",
            "X-Permitted-Cross-Domain-Policies",
            "X-Robots-Tag",
            "X-XSS-Protection",
            "Referrer-Policy",
            "tlsTrusted",
            "tlsProtocol",
            "tlsDeprecatedProtocol",
            "tlsCertificate",
            "tlsCertificateLifetime",
            "tlsCipherSuite",
            "tlsCertificatePolicy",
            "tlsAddressParity",
            "cookieSecure",
            "cookieHttpOnly",
            "cookieSameSite",
            "cookiePrefix",
            "tlsChain",
            "tlsOcspStapling",
            "tlsCertificateTransparency",
            "tlsEarlyData",
            "corsOriginRestricted",
            "traceMethodDisabled",
            "versionDisclosure:Server",
            "versionDisclosure:X-Powered-By",
            "webfingerVersionDisclosure",
            "directoryListing"
          ],
          "type": "string"
        },
        "type": "array",
        "uniqueItems": true
      },
      "output_format": {
        "default": "dashboard",
        "description": "What the result page renders for the visitor.",
        "enum": [
          "dashboard",
          "json",
          "csv",
          "sarif",
          "pdf"
        ],
        "type": "string"
      },
      "release_track": {
        "default": "auto",
        "description": "How the version is judged. Changes the rating's reasoning and nothing about the scan itself.",
        "enum": [
          "auto",
          "rolling",
          "production",
          "lts"
        ],
        "type": "string"
      },
      "target_url": {
        "description": "Public OpenCloud base URL or hostname. It must resolve publicly; a private, loopback or link-local address is refused and retrying will not help.",
        "type": "string"
      }
    },
    "required": [
      "target_url"
    ],
    "type": "object"
  },
  "page": "/"
}

{
  "name": "check_opencloud_security",
  "kind": "answer",
  "impl": "declarative",
  "description": "Scans an OpenCloud security target URL for vulnerabilities, hardening settings, and release track compliance.",
  "inputSchema": {
    "type": "object",
    "properties": {
      "target_url": {
        "type": "string",
        "description": "opencloud.example.com"
      },
      "release_track": {
        "type": "string",
        "enum": [
          "auto",
          "rolling",
          "production",
          "lts"
        ]
      },
      "output_format": {
        "type": "string",
        "enum": [
          "dashboard",
          "json"
        ]
      },
      "ignore_hardenings": {
        "type": "boolean"
      }
    },
    "required": [
      "target_url"
    ]
  },
  "page": "/"
}