01
What is exposed
TLS, headers, CORS, exposed configuration and debug pages. Bounded reads within your scope.
External perimeterFROM AI-BUILT TO RELEASE-READY
Test the security of your website or API.
Your AI assistant configures the project, test accounts and fixtures. You approve preparation plans, permissions and scan decisions. The Scantelio scanner tests the target and records results.
Start on Free·No repository upload to Scantelio
Websites & web appsAPIs & SaaSBackends for apps & botsStores & marketplacesCRM & ERP
01 / YOUR EDITOR. YOUR PROJECT.
How to connect your AI editor to a security scan
You do not have to work out every field alone. Your assistant proposes settings; Scantelio checks permissions, quotas and consent before a scan starts.
MCP / Cursor
Install link, then browser sign-in
Choose your project and permissions in the dashboard. Give your assistant the starter task. Revoke access whenever you need to.
Open connection setupFast setup. Clear control.
- Your assistant reads project context in your editor. No full-code upload is needed.
- Test credentials use the protected helper, form or staging MCP tools; never chat.
- Your AI cannot buy a subscription or approve a scan on your behalf.
Setup guides are available for these clients. MCP and authentication availability depend on the editor version and account; each client requires separate compatibility validation.
02 / COVERAGE
It works. But who can access it?
See what was tested, what was found and which scenarios remain outside the scope.
02
Who can access someone else’s data
Cross-account access, JWT and approved staging scenarios using known test fixtures.
Fixture-based checks03
Which versions are vulnerable
10 ecosystems, from npm and Python to Java, Go and .NET. Monitoring scoped to your project’s packages and exact versions.
10 ecosystems / CycloneDX03 / MORE THAN AN ISSUE LIST
What a security report shows
Each finding includes evidence, context and remediation guidance. Share it with your assistant, review the proposed fix and retest that specific scenario.
Explore a sample reportReports distinguish completed, skipped and inapplicable checks. A clean result is not a guarantee of complete security.
04 / AFTER THE FIRST SCAN
Keep shipping. Keep checking.
The value goes beyond one report. Add release checks, dependency monitoring and retests within your plan.
Checks in CI/CD
Get release-check results in your pipeline. An incomplete check is not presented as a pass.
Relevant Telegram alerts
New known vulnerabilities matched to your dependencies and affected versions, not the entire CVE catalog.
Verify the fix
Rerun a scenario after a code change and track the result. Schedules help keep checks consistent.
05 / PRICING
Start free. Build a checking routine.
Automated security checks for your product. Paid subscriptions are coming soon.
Free
For your first external check
$0.00 / month
- AI connection within your plan’s permissions and limits
- External checks and full findings
- Telegram notifications
- 1 product(s) · 1 addresses total
- 3 short checks / month
- 7 days history
Pro
For ongoing product checks
$9.00 / month
$90.00 / year — billed annually in full
- AI connection within your plan’s permissions and limits
- External checks and full findings
- API and cross-user access checks
- Release checks via CI/CD
- Project dependency vulnerability monitoring
- Telegram notifications
- Scheduled daily checks
- Fix tasks and targeted retests
- 1 product(s) · 3 addresses total
- Daily short check per product
- 10 full scans + 20 retests per month
- 2 test accounts per product
- 90 days history
Business
For multiple projects and a team
$29.00 / month
$290.00 / year — billed annually in full
- AI connection within your plan’s permissions and limits
- External checks and full findings
- API and cross-user access checks
- Release checks via CI/CD
- Project dependency vulnerability monitoring
- Telegram notifications
- Scheduled daily checks
- Fix tasks and targeted retests
- 3 product(s) · 9 addresses total
- Daily short check per product
- 40 full scans + 80 retests per month
- 6 test accounts per product
- Up to 5 members, roles and team policies
- 180 days history
Prices are shown in each plan’s currency. Taxes and the final total appear at checkout. Monthly allowances reset each UTC calendar month; annual billing does not increase them.
A few answers before your first scan.
Is it really one click?+
Not on the first connection. Sign in, choose a project, verify target ownership and approve the scope. Your assistant can prepare the setup; repeat scans are simpler once everything is configured. Missing data, plan limits or expired consent may require another step.
Do I need an AI subscription?+
Scantelio connects to your existing MCP-capable client. Editor access and any AI usage charges are separate from Scantelio. You can also configure and scan a project directly in the dashboard.
Does my code or password go to the AI?+
Scantelio does not need the full repository. Your assistant uses context available in your editor under that editor’s permissions. Use the protected helper or form to keep test credentials out of AI history. An authorized assistant can also submit disposable staging credentials through write-only MCP tools; the MCP client may retain arguments. Never share production credentials or .env files.
Does a clean report mean my product is secure?+
No. It means no issue was found in the completed scenarios. Skipped and inconclusive checks remain visible.
Can I check a mobile application?+
You can connect its public backend and HTTP API. APK, IPA, binaries and local storage are not covered.
Does Scantelio block attacks?+
No. The service finds supported issues. It does not block attacks, automatically fix code or detect every zero-day.
YOUR NEXT STEP
Give your project its first security check.
Start on Free. Connect your assistant or add a target manually, and see what the available checks reveal about your app.
Set up your project with AISee a sample report first