Olena,
Yes, Proof/Subject7 does cross site scripting (and in general passive and active dynamic security checks) via our security addon which is based on OWASP ZAP (https://www.zaproxy.org/). This is an addon that your team does not have today. Please let us know if you would like to see a demo of it.