Public and private scans, limits and Pro
Who can see an AI Site Scanner report, how private scans work and why they need Toolz Pro, the daily scan allowance per account and the per-minute rate limit.
Scans are public by default. A public scan gets a shareable report link and, if it is the domain's newest public scan, a row in Recently scanned and the public directory. A private scan gets the same link but is never listed, and running one needs a Toolz Pro account. Separately, every scan counts against a daily allowance for your account type, from the scanner page, the command line, the MCP server or the HTTP endpoint alike, and every request is subject to a limit of 6 scans per minute per IP address.
What is the difference between public and private?
| Public | Private | |
|---|---|---|
Report link at /ai-scan/r/<id> |
Yes | Yes |
| Anyone with the link can open it | Yes | Yes |
| Listed in Recently scanned and /ai-scan/scans | Yes, as the domain's newest public scan | Never |
| Counts toward Improved after a scan | Yes | No |
| Counts toward the stats (total, average, not agent-ready) | Yes | Yes |
| Shown in the browser's own Your scans list | Yes | Yes |
| Search engines index the report | No, report pages are noindex |
No |
| Who can run it | Anyone | Toolz Pro accounts |
Private means unlisted, not secret. The report id is 12 random characters and cannot be guessed, but anyone you send the link to, or who sees it, can open the report.
How do I run a private scan?
Sign in with a Toolz Pro account, then pick Private in the Public / Private control beside the scan button before you scan. The line next to it changes to "Only people with the link can see the report."
Without Pro, Private shows a Pro badge, and clicking it explains the feature and links to pricing instead of switching. The control is only the visible half: the server checks as well. When a scan asks to be private, the scan route sends your sign-in token to the Toolz.dev backend and asks for your account's current plan, so an upgrade counts straight away even if your token is older than the upgrade. If the check cannot confirm Pro, or the backend does not answer within 3 seconds, the request is refused with:
Private scans are part of Toolz Pro. Run it as a public scan, or upgrade at toolz.dev/pricing.That refusal is HTTP 403 with code: "PRO_REQUIRED" in the HTTP endpoint, and it happens before the rate limit, so it does not use up one of your scans for the minute.
The command line and the MCP server do not sign in, so their scans are always public.
How many scans can I run a day?
The scanner page shows your allowance under its controls, as "N of M free scans left today", and reads it from the Toolz.dev usage service each time rather than printing a fixed number. The allowance depends on your account type:
| Account | Allowance |
|---|---|
| Guest (not signed in) | A daily number per device, set by the usage policy. The page also quotes the signed-in allowance next to a "Create a free account" link |
| Free account | A higher daily number, set by the usage policy |
| Toolz Pro | Unlimited. The page shows "Unlimited scans with Pro" |
The numbers are configured per tool by Toolz.dev and can change, which is why the page reads them live. A whole-site scan counts as one scan. When the allowance runs out, the scanner says "You have reached your daily scan limit. Sign in or upgrade for more." and the counter resets the next day.
The allowance is enforced by the scan endpoint itself, so the command line, the MCP server and direct HTTP calls use it too. A signed-in caller is counted by account; a guest on the scanner page by device; a guest calling from the command line, the MCP server or the HTTP endpoint by IP address. Past the allowance the endpoint answers HTTP 429 with code: "DAILY_LIMIT".
What is the per-minute rate limit?
The scan endpoint allows 6 scans per IP address in any 60-second window. The seventh gets HTTP 429 and:
Too many scans. Wait a minute and try again.Every request counts toward the window, including ones that were refused, so retrying in a tight loop keeps you limited. Wait a full minute, then try again. The limit applies to all callers alike: the scanner page, the CLI, the MCP server and your own code. A private-scan request refused for lack of Pro is the one exception, as noted above.
In a CI pipeline that scans several sites, space the scans out or run them in sequence with a pause, so a single runner stays under 6 a minute.
What does Toolz Pro add to the scanner?
Two things: private scans, and unlimited scans on the scanner page. Everything else, including all 31 checks, whole-site scans, fix prompts, stored reports and history, is available to everyone. Pricing has the plans.