We run payments-security certifications for a living, and over and over we wanted a quick outside-in read on a domain before doing the deep work — is the TLS sane, are the headers there, is anything exposed that shouldn't be. Nothing free did it well. And nothing checked the thing that started keeping us up at night: exposed MCP endpoints. Once everyone started wiring AI agents into their infrastructure, that became real attack surface — and it's invisible from the runtime platforms most teams rely on, because it only shows from the outside. So we built the scanner we wanted. The passive scan is free and stays free. No account to run your first one, real findings written out in full, and every finding mapped to the PCI requirement it touches — not a letter grade and a shrug. Would genuinely love the hard feedback. If it misses something on your domain, or flags something it shouldn't, tell us — that's the stuff we most want to hear on launch day.

flaw.co

Free security scan that catches your exposed AI endpoints

Free security scan that catches your exposed AI endpoints