AI endpoints
MCP servers, model APIs and agent endpoints that answer anyone, on the usual ports and common AI server ports.
Free URL scan
See what your website exposes to AI agents.
Guard Cloud checks a website you control for what anyone, or anyone’s AI agent, could reach: open MCP servers and model APIs, AI keys in served files, content that steers agents, and the TLS, header and path basics. No account. No AI judging the results: the checks are fixed, and every finding shows the request and the response.
What it checks
Five areas, scored the way our assessment scores a device.
A finding means something is exposed to anyone who asks for it. It doesn’t mean anyone used it, and a clean scan isn’t proof that nothing is exposed.
AI keys in served files
AI provider keys in the scripts, source maps and files your site serves. The report shows where, never the whole key.
Content that steers agents
Instructions in pages and files that an AI agent reading your site could follow.
Transport
TLS, certificates and security headers.
Exposed paths
Files that are often left reachable by mistake, such as environment files and repository folders.
How it behaves
It reads what your site serves, and nothing more.
Only sites whose owner proved control get scanned, and the proof is checked again just before the scan starts.
- GET requests only, one at a time: it never signs in, submits forms or sends exploit payloads
- Only the verified host name, on ports 80 and 443 and a short list of common AI server ports
- Every request names itself:
RunewardGuardURLScan/1in the User-Agent - Results stay at an unguessable link. Download them as JSON, or print them