urlscan.io AI Tool for Web Security Analysis - n8n Workflow

Cybersecurity professionals needing automated web analysis via AI.
Developers building advanced AI agents (e.g., using LangChain) who require external real-time data ingestion.
n8n users looking for advanced examples of mcpTrigger and tool integration within a complex n8n workflow.
Automation specialists looking to create highly reusable n8n templates for security tasks.

This n8n workflow is a specialized example of creating powerful tools for AI agents. By utilizing the urlscan.io service, this solution allows an AI model to perform critical web security tasks—such as submitting URLs for analysis, retrieving specific scan results, or querying recent scans—all within a single, coherent n8n endpoint. This setup transforms the n8n workflow into a callable microservice, significantly extending the capabilities of the AI agent without requiring it to natively handle API calls. This specific n8n workflow acts as a centralized server, registering three distinct urlscan.io operations under one AI tool definition, making this one of the most flexible n8n templates available for security automation.

This sophisticated n8n workflow functions purely as an AI tool endpoint, initiated by the custom n8n trigger designed for AI communication.

1. Trigger Reception: The process begins with the urlscan.io Tool MCP Server n8n trigger. This specialized n8n trigger listens for requests from an external AI agent or LangChain execution context. The incoming request includes parameters specifying the desired urlscan.io operation (e.g., performing a new scan or getting results).


2. Tool Registration: Crucially, this single n8n trigger node is connected to three separate urlScanIoTool n8n node instances: Get a scan, Get many scans, and Perform a scan.


3. Execution Routing: Based on the function the AI agent specifies in its prompt, the n8n workflow intelligently routes the request to the correct urlScanIoTool n8n node.


4. Action Execution: The selected urlscan.io n8n node executes its designated operation (e.g., submitting a URL for scanning).


5. Response: The result of the urlscan.io operation (such as the scan ID or the full security report) is returned immediately back through the urlscan.io Tool MCP Server n8n trigger to the requesting AI agent, allowing the agent to use this real-time security data in its response generation. This architecture exemplifies how to use an n8n template to provide highly granular tool access.

1. Import: Copy the provided JSON data and import it directly into your n8n instance via the Workflows section.


2. Credentials Setup: This n8n workflow relies on the urlscan.io n8n node. You must configure credentials for the urlscan.io service (API Key). Locate one of the urlScanIoTool n8n nodes and select 'Create New Credential' under the resource settings, providing your urlscan.io API key.


3. AI Trigger Setup: The primary n8n trigger, urlscan.io Tool MCP Server, is configured as a Tool for an AI agent. After saving the n8n workflow, note the generated URL or tool ID, which you will use to register this n8n tool with your external AI orchestrator (like a LangChain application).


4. Activation: Ensure the n8n workflow is active (toggled 'On') to allow the AI agent to successfully call the n8n trigger endpoint.

urlscan.io Tool MCP Server (mcpTrigger n8n trigger):
Function: Serves as the dedicated entry point for the AI agent or LangChain framework. This is the specialized n8n trigger that exposes the functionalities below as a structured tool.
Key Configuration: Configured to accept ai_tool connections, linking it to the urlscan.io action nodes, allowing the AI agent to choose the specific function it needs.
Get a scan (urlScanIoTool n8n node):
Function: Configured to retrieve the detailed results of a single, previously executed urlscan.io scan using its UUID or scan ID. This n8n node provides specific result data.
Key Configuration: Operates against the "Scan" resource, using the "Get" operation.
Get many scans (urlScanIoTool n8n node):
Function: Used by the n8n workflow to query and list multiple scans based on specific search criteria or retrieval limits.
Key Configuration: Operates against the "Scan" resource, using the "Get Many" operation.
Perform a scan (urlScanIoTool n8n node):
Function: Submits a new URL to urlscan.io for security analysis, initiating a fresh scan job. This is the primary action performed by this n8n node.
Key Configuration: Operates against the "Scan" resource, using the "Create" operation (Perform Scan).