CodexPluginStats
← Plugin catalog
Developer Tools

Scan.now

Targa Limited v0.1.4

Website security and phishing

Create a free account to save this plugin.

From the developer

Declared capabilities

  • Website security scanning
  • TLS and header checks
  • Phishing-link inspection

Cost & access

The plugin performs read-only security checks and does not complete transactions.

Declared limitations

  • Do not scan a site without permission
  • Do not claim exploit or intrusion capabilities
  • Do not use the plugin for unrelated questions

Onboarding example

Scan my website for security problems.

View onboarding source →

Sources & dates

Developer declarations; not independently tested. Listing last checked Nov 6, 2026. Package observed Nov 6, 2026.

View package source →

Description

From the marketplace listing

Run passive, read-only website security checks and inspect suspicious links for phishing signals. Scan.now checks public pages, TLS, security headers, DNS and email posture, JavaScript libraries, redirects, lookalike domains, and other observable signals without sending exploit payloads.

Language: English · Automatically detected from descriptions.

ChatGPT marketplace listing ↗Website ↗Privacy policy ↗Terms ↗Support ↗

Changes

No changes recorded yet. Follow this plugin to keep track of future changes.

First seen Nov 6, 2026. Last seen Nov 6, 2026.

Keywords

Files & skills

File archives

Plugin package9 files · 396 KBBrowse files →
Skill instructions
scan-now-tools1.36 KB

View saved version →

---
name: scan-now-tools
description: Use Scan.now when the user wants a passive security assessment of a website they are authorized to test, or wants to inspect a suspicious public link for phishing signals.
---

# Scan.now tools

Use `scan_website_security` only after the user states that they own the target website
or have explicit permission to assess it. If that authorization is absent, ask for it
before calling the tool. Set `authorized` to true only after that confirmation.

Choose the narrowest useful scope:

- `full` for a broad passive assessment.
- `tls` for certificates, protocol support, and HTTPS behavior.
- `headers` for HTTP security headers, cookies, CORS, and related page controls.
- `email` for SPF, DKIM, DMARC, DNSSEC, CAA, and email-domain posture.
- `js` for public JavaScript inventory and known vulnerable library versions.

Use `check_phishing_link` when the user wants to understand whether a public link looks
deceptive or where it redirects. Explain that a low score is not a guarantee: a new or
unreported phishing page may not yet appear on blocklists.

These tools are passive and read-only. They do not exploit findings, bypass access
controls, guess credentials, scan private networks, or prove that a target is secure.
Do not help use the results for unauthorized access. Prefer the finding's
`reference_url` when the user asks how to fix an issue.

Release notes

Version 0.1.4 explicitly declares anonymous MCP authentication so the OpenAI submission portal can import the public endpoint and begin domain verification.

Declared in the saved package. Remote tools may change independently.

Package details

Publisher declarations from the archived package. These are separate from our research and the live service's terms.

Package author
Targa Limited
Keywords
See keywords
Getting started skill
./skills/scan-now-tools/SKILL.md
Commerce declaration
Does not support commerceThis does not establish whether access is free or paid.
Review scenarios
5 positive · 3 negativeScenario counts, not test results.

Declared capabilities

  • Website security scanning
  • TLS and header checks
  • Phishing-link inspection
  • DNS and email posture

Package observed Nov 6, 2026.

plugin.json.codex-plugin/plugin.json
Technical details
First seen
Nov 6, 2026 · 00:00 UTC
Last seen
Nov 6, 2026 · 00:00 UTC
Collection status
Collected

plugin_asdk_app_6ac12028181c819191a16527e59340e3

Download plugin data (JSON)