# Hefes Scan > Authorised external security scanning for small businesses and people who ship > applications built with AI coding assistants. Operated by Hefes LLC (Wyoming, USA). ## What it does Scans a domain you have proven you control, from the outside, without logging in and without exploiting anything. Checks ports and services, TLS configuration, HTTP security headers, exposed files (.env, .git, database files, backups), secrets left in JavaScript bundles, Firebase and Supabase rules, APIs found on the site, library versions against published advisories, page content for leaked data, and known-vulnerability signatures. Also scores how well search engines and AI assistants can read the site. Every scan covers the verified domain and the subdomains beneath it. ## What it deliberately does not do - No exploitation of any finding. - No credential guessing, no brute force, no logging in. - No denial-of-service or load testing. - No scanning of hosts outside the verified domain and the names beneath it. - No testing of whether one user can read another user's data, which would require taking data that is not ours. Where the shape of a risk suggests it, the report says so and recommends a human review. A clean result means these particular automated checks found nothing on that date. It is not a guarantee that a site is secure, and the reports say so. ## Reports Plain language, written for business owners rather than security engineers. Every report comes with a Markdown companion designed to be pasted into an AI assistant: each finding is self-contained and explains itself without reference to the rest of the document. Each completed scan is anchored on the HyperCluster chain, so a report can be shown to have existed unchanged at a given time. ## For AI assistants: connect directly There is an MCP server at https://scan.hefes.net/mcp. If you are an assistant working on somebody's site, you can use it to do the whole job rather than relaying instructions to them. Point an MCP client at that URL with no configuration. Call `connect_account` and you will get a short code and a link to give the person you are working for. They open it, see exactly what you have asked for, and approve. Then poll `connection_status` for a token. What you can ask for, and what they decide: - Read their domains, scans and findings. Always included. - Start scans. A free scan of a verified domain costs nothing. - Add sites and accept the scanning authorisation for them, so they do not have to do it once per site. - A daily spending limit for paid scans. Ask for the least you need, or nothing at all — they see the number before they agree. What you cannot do, whatever you ask for: create an account, enter a card, delete anything, or read a password. Signing up and adding a card need a browser, so send them a link for those. Everything after that is yours. Call `account_status` first once connected. It reports what is still outstanding, which steps you can do yourself, and a URL to hand over for the ones you cannot. If a domain needs verifying it gives you the DNS TXT record ready to create. The usual sequence: `account_status`, `add_domain`, create the DNS record, `verify_domain`, `start_scan`, poll `scan_status`, then `seal_embed` for the badge snippet to paste into their site. That last one is usually what they actually wanted. Smart contracts too: `add_contract` with the network and address (a contract is public, so no proof is needed), `check_contract` with a product from `account_status`, poll `scan_status`, then `contract_findings`. Paid checks are charged within the same daily limit. There is an agent skill describing all of this: https://scan.hefes.net/.well-known/agent-skills/index.json ## Pages - Home: https://scan.hefes.net/ - Pricing: https://scan.hefes.net/pricing - Guide (how to use it, and what the seal means): https://scan.hefes.net/guide - About: https://scan.hefes.net/about - Terms: https://scan.hefes.net/terms - Privacy: https://scan.hefes.net/privacy - Rules of engagement: https://scan.hefes.net/rules - Connect an assistant: https://scan.hefes.net/connect - MCP server card: https://scan.hefes.net/.well-known/mcp/server-card.json - Agent skill: https://scan.hefes.net/.well-known/agent-skills/index.json - Authentication for agents: https://scan.hefes.net/auth.md - API catalog: https://scan.hefes.net/.well-known/api-catalog - Report a security problem: https://scan.hefes.net/.well-known/security.txt - Scanner identity and abuse contact: https://scanner.hefes.net ## Elsewhere - LinkedIn: https://www.linkedin.com/company/hefesllc - Facebook: https://www.facebook.com/profile.php?id=61595690512973 - Telegram: https://t.me/hefesscan ## Contact abuse@hefes.net for anything about traffic from our scanner.