Documentation

How this platform works, in detail.

Every kind of assessment, what each one is allowed to touch, and how to read what comes back. Where a capability has a limit, the limit is stated with it rather than left for you to find.

29 pages. New here? Start with what Webcuris does.

Getting started

What the platform is, and the shortest path from signing up to a finding you can act on.

What Webcuris doesA continuous security assessment for websites, repositories and AI systems — what it checks, what it refuses to check, and how sure it says it is.

Your first scanFrom signing up to a result you can act on, without connecting anything.

The dashboardWhere the portfolio stands today, and what changed since the last time you looked.

Running a scan

Every kind of assessment this platform performs, and what each one is allowed to touch.

Scanning a websiteThe standard pass: thirty-two checks that need nothing more than an ordinary browser would do.

Deep scanFour additional checks that send requests an ordinary visitor would not — and stay locked until the domain is proved yours.

Verifying ownershipOne DNS TXT record — the only setup step the platform asks for.

Scanning a repositoryTen checks across dependencies, secrets, code patterns, containers, infrastructure and AI usage.

Scanning on your own machineFor code that must not leave your network: the CLI scans locally and uploads only findings.

Cloud testingTwo different things: the infrastructure committed to your repository, and a read-only posture scan of a live account.

AI securityAn inventory of the AI components in your code, and 18 rules over how they are wired together.

AI agent securityA runtime checkpoint for agents acting on your systems: what a tool call is allowed to do, what a session has accumulated, and a tamper-evident record of both.

Reading the results

Findings, confidence, scores, and the reports you can hand to somebody else.

FindingsEvery problem the platform found, with the evidence it was derived from.

Confidence and scoringHow sure the engine is about each finding, and what the score does and does not mean.

Attack surfaceEverything reachable from outside, in one table, with the unknowns marked as unknown.

DependenciesThe resolved dependency tree across the portfolio, with known advisories matched against it.

Reports and exportsNine reports, each written for a different reader — what you hand to an engineer, an executive, or somebody doing due diligence on you.

What gets detectedThe full taxonomy: 46 checks, 41 static code rules, 18 AI rules, and 80 distinct CWE classes.

Operating the platform

Assets, monitoring, teams, compliance mapping, and the record of who did what.

AssetsThe things you have asked the platform to watch, and who added each one.

Monitoring and alertsScheduled re-scans, and a message when something about the perimeter changes.

Compliance mappingFindings mapped onto 5 frameworks — as context, never as audit evidence.

Organizations and usersWorking as a team, with roles that decide what each person can see.

IntegrationsWhere findings can go, and what credentials the platform holds.

Audit logA tamper-evident record of what happened in the account.

Your dataWhat is stored, for how long, and what leaves Webcuris.

Developer reference

The CLI, API keys, pipeline gating, and webhooks.

Command-line interfaceScan a repository without uploading it, scan a container image, or drive the Webcuris API from a terminal.

API keysBearer tokens for the CLI and CI, scoped to the role of the account that created them.

Gating a pipelineFail a build on a severity threshold you choose, using the same engine that runs in the product.

WebhooksWhere a monitoring result goes when nobody is looking at the dashboard.

MCP server: use Webcuris from an AI assistantConnect Claude, ChatGPT, Cursor, Claude Code, VS Code or any MCP client to your account in a minute, step by step. Scan, read findings and export SBOMs from a conversation, with exactly your plan's abilities.