EverThread

Official

by PB-Digital-LLC · JavaScript

Plain-English website security check for agents: certificate, headers, scripts, forms, spam.

io.github.PB-Digital-LLC/everthread (MCP Server)

The MCP server io.github.PB-Digital-LLC/everthread provides a plain-English website security check for agents. It focuses on evaluating a website’s certificate, headers, scripts, forms, and spam, as indicated by its description.

🛠️ Key Features

Certificate checks
Headers inspection
Scripts review
Forms evaluation
Spam-related checks

🚀 Use Cases

Run agent-assisted website security reviews
Assess web pages for certificate, headers, scripts, forms, and spam issues

⚡ Developer Benefits

Plain-English outputs intended for agents
Clear scope of supported security check categories

⚠️ Limitations

Described capabilities are limited to certificate, headers, scripts, forms, and spam checks (no other functions are specified).

Topics

climcpmcp-serversecurity-headerssslwebsite-securityai-agentsmodel-context-protocolsecurity-monitoring

README.md2 KBView on GitHub

everthread

A website security check that explains itself in plain English. Free, no key, observation only.

code

npx everthread check yourbakery.com

code

EverThread · yourbakery.com
WORTH A LOOK  Nothing alarming, but one thing is worth fixing.

FIX THIS WEEK  Your site lets browsers fall back to an insecure connection
  The Strict-Transport-Security header is not being sent. ...
  Fix: Send the technical line below to whoever runs your site. ...

One fresh check per site per week. Inside that week you get the stored result, its age, and a note about daily watching.
--json for machines, --fail-on urgent (or attention) to fail a CI step.
everthread explain tls.expiring and everthread findings for the explanations behind every finding.

As an MCP server

json

{ "mcpServers": { "everthread": { "command": "npx", "args": ["-y", "everthread", "mcp"] } } }

Tools: check_site, explain_finding, list_findings. Works with Claude Code, Claude Desktop, Cursor, and anything else that speaks MCP.

What it does and doesn't do

It loads the home page the way a browser does and reads the certificate, security headers, scripts, forms, frames, redirects, a fixed handful of well-known files, and the page text. It never logs in, probes for hidden paths, or runs exploit tooling. Public results withhold the exact address of an exposed file; the site owner sees it after signing up. Only check sites you own or have permission to check.

Docs: https://everthread.live/api · Every finding explained: https://everthread.live/fix/

MCP Badge

Install

Add to VS Code Add to Cursor

claude_desktop_config.json