Public API
One call. One plain-English report card.
The same free check as the box on our home page, for scripts, CI pipelines and AI agents. No key, no account. Observation only: we load the home page the way a browser does.
Check a site
curl "https://security.everthread.live/api/v1/check?url=yourbakery.com" \
-H "X-EverThread-Source: my-tool"
Returns JSON with a verdict (clean, attention, urgent, or blocked when the site walled us off), a one-line headline, and items, each with what we saw, why it matters, how to fix it, a developer line, and a link to the full explanation. The same result is cached for a day, and each address gets a few checks per half hour.
From the terminal
npx everthread check yourbakery.com
npx everthread check yourbakery.com --json
npx everthread check yourbakery.com --fail-on urgent # for CI
As an MCP server for your agent
{ "mcpServers": { "everthread": { "command": "npx", "args": ["-y", "everthread", "mcp"] } } }
Tools: check_site, explain_finding, list_findings. Works with Claude Code, Claude Desktop, Cursor and anything else that speaks MCP.
Explanations
GET https://security.everthread.live/api/v1/explain
GET https://security.everthread.live/api/v1/explain/tls.expiring
Every finding type, in the words we send customers. The same text lives on the fixes pages.
What we never do
Log in, guess passwords, probe for hidden paths beyond a fixed handful of well-known files, or run exploit tooling. Public results never include the exact address of an exposed file; the site's owner sees that in their dashboard. Please only check sites you own or have permission to check.
Specification
openapi.json · llms.txt · questions to hello@everthread.live
Want it watched, not just checked?
Sign up free and we check your site every day and email you in plain English when something changes.