# Cyrecon (`cy_agents/cyrecon-scanner`) Actor

Passive external security assessment for any domain — a risk score/grade overall and per-category (application, infrastructure, human risk, patching, reputation, data exposure), plus every finding with severity. For security-posture checks and vendor risk assessment pipelines.

- **URL**: https://apify.com/cy\_agents/cyrecon-scanner.md
- **Developed by:** [Cy Agents](https://apify.com/cy_agents) (community)
- **Categories:**
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

Pay per usage

This Actor is paid per platform usage. The Actor is free to use, and you only pay for the Apify platform usage, which gets cheaper the higher subscription plan you have.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-usage

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

## CyRecon – Website Security & Risk Scanner

Scan any website for publicly visible security risks and get a clear risk score, grade, severity-ranked findings, and technical context — all from one passive external assessment.

CyRecon is a passive, non-intrusive website security and external risk scanner designed to quickly assess the security posture of any publicly accessible domain.

Enter a domain and CyRecon analyzes externally observable security signals across six risk domains, then returns a structured JSON result containing:

- Overall risk score
- Overall risk grade and risk band
- Score and grade for each risk domain
- Severity-ranked findings
- Finding counts
- SSL/TLS certificate information
- Technology detected
- Open ports and services
- Hosting and ISP information
- Country information
- Mail provider information
- Scan caveats and limitations

No credentials, login, or application access is required.

### Why CyRecon?

Security assessment often requires multiple tools, checks, and manual interpretation.

CyRecon brings multiple publicly observable security signals into one standardized assessment.

With one domain input, you get:

`Domain → External Checks → Findings → Risk Scores → Structured JSON`

This makes CyRecon useful not only for security teams, but also for:

- Vendor risk assessment
- Third-party risk management
- Cyber insurance underwriting
- Due diligence
- Internal IT reviews
- Automated risk pipelines
- Partner and supplier assessment
- Commercial risk workflows

### Input

Single field, by design:

| Field | Type | Required | Notes |
|---|---|---|---|
| `url` | string | yes | Target site — accepts a bare domain, a full URL with or without `https://`, with or without a path, or a markdown-style link. e.g. `example.com`, `https://example.com/`, `[example.com](https://example.com)` |

### Output (one dataset record per run)

```json
{
  "vendor": "example.com",
  "status": "ok",
  "scannedAt": "2026-09-08T00:00:00Z",
  "riskScore": 88,
  "riskGrade": "BBB",
  "riskBand": "Above Average",
  "domainScores": [
    { "key": "app_sec", "name": "Application Exposure", "score": 79, "grade": "BB" }
  ],
  "findingCounts": { "critical": 0, "high": 0, "medium": 3, "low": 9, "total": 12 },
  "findings": [
    { "domain": "app_sec", "domainName": "Application Exposure", "severity": "MEDIUM", "title": "Missing Header: content-security-policy", "detail": "..." }
  ],
  "context": {
    "certificate": { "notBefore": "...", "notAfter": "...", "daysUntilExpiry": 214 },
    "technologyDetected": ["nginx", "React"],
    "openPorts": [{ "port": 443, "service": "https" }],
    "hosting": "Cloudflare", "isp": "Cloudflare, Inc.", "country": "US",
    "mailProvider": "Google Workspace"
  },
  "caveats": []
}
```

`status` is one of:

- `"ok"` — scan completed, full result as above
- `"error"` — the domain was invalid, unreachable, or unsafe to scan; see `error` for why
- `"cooldown"` — this domain was scanned too recently; see [Rate limiting](#rate-limiting)

`context` is reference data the scan collects but doesn't score (certificate
dates, detected tech, open ports, hosting info) — there's no "correct" value
to penalize deviation from here, unlike `findings`. `caveats` lists any known
limitations of that specific run (e.g. a CVE lookup that hit a rate limit),
so an incomplete check reads as disclosed, not silently clean.

### Rate limiting

The same domain can't be scanned more than once every 15 minutes, to avoid
placing repeated load on a target site. A second run against a domain still
in cooldown returns immediately with:

```json
{ "vendor": "example.com", "status": "cooldown", "error": "This domain was scanned within the last 15 minutes. Try again in about 9 minute(s)." }
```

This is scoped per domain — scanning a different domain is never affected
by another domain's cooldown.

### Scope

Passive, non-intrusive scan and deterministic scoring only — no active
exploitation, no authenticated testing, no full port sweep. Every check is
an outside-in HTTP/DNS/TCP observation of what's already public; nothing
here logs in, submits data, or attempts to access anything not already
exposed. This Actor has no external dependencies beyond the scan targets
themselves, so it runs identically for anyone.

### Limitations

- **External and passive only.** Everything here is visible from the outside, without credentials.
- **A snapshot, not a guarantee.** Results reflect the moment of the scan; a clean result today doesn't mean the target stays that way tomorrow, and it isn't a certification that the target is free of risk.
- **Some findings carry false-positive risk.** A handful of checks are heuristic and are flagged as such in the finding's own detail text. Worth a manual look before treating them as certain.
- **CVE lookups are capped at 12 per scan.** If a site uses many detected technologies, not all of them may get checked in a single run. See the `caveats` field in the output for when this happens.

### Responsible Use

CyRecon is intended for legitimate security assessment, research, and business purposes. Please scan only domains that you own or are authorized to assess.

CyRecon performs passive, non-intrusive external checks and provides security signals for assessment and prioritization. Results are based on publicly observable information and may not identify every security issue or may occasionally require validation.

By using CyRecon, you are responsible for ensuring that your use complies with applicable laws, permissions, and third-party requirements.

CyRecon is provided as an assessment tool and does not guarantee the security or vulnerability status of any domain.

# Actor input Schema

## `url` (type: `string`):

The site to assess, e.g. example.com or https://example.com.

## Actor input object example

```json
{
  "url": "example.com"
}
```

# Actor output Schema

## `results` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "url": "example.com"
};

// Run the Actor and wait for it to finish
const run = await client.actor("cy_agents/cyrecon-scanner").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "url": "example.com" }

# Run the Actor and wait for it to finish
run = client.actor("cy_agents/cyrecon-scanner").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "url": "example.com"
}' |
apify call cy_agents/cyrecon-scanner --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,cy_agents/cyrecon-scanner"
        }
    }
}

```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/tCKW6w2PhxD8QUFbV/builds/GbwPfCNK3u0AafjG9/openapi.json