mcpField
E
EverThread

EverThread

Local
everthread.liveSecurity0Updated 5w ago
RepositoryVisit website

About EverThread

EverThread is an observation-only website security checker that explains findings in plain English. It is aimed at site owners and agents, and offers both a CLI and MCP tools without logging in or probing hidden paths.

Key features

  1. 01Check certificates and security headers
  2. 02Review scripts, forms, frames, and redirects
  3. 03Read selected public files and page text
  4. 04Explain findings and list available checks
  5. 05Output JSON or fail CI on selected severity

Use cases

  1. 01Check a website's basic security posture
  2. 02Understand a finding and its suggested fix
  3. 03Use findings to fail a CI step
  4. 04Ask an MCP client to check a site

MCP support

Exposes `check_site`, `explain_finding`, and `list_findings` tools to MCP clients. Checks observe public site content and do not log in or probe hidden paths.

Configuration

Local server config is the same for every client. Copy it into your client’s MCP config file.

mcp.json · Universal config
{
  "mcpServers": {
    "pb-digital-llc-everthread": {
      "command": "npx",
      "args": [
        "-y",
        "everthread"
      ]
    }
  }
}
Run commandnpx -y everthread

Local servers need a runtime on your machine (e.g. Node.js 18+). Config file locations differ by client; see your client’s docs.

Packages
npmeverthread0.1.3

Tools

3

Saved tool list · updated 2w ago

ParameterTypeRequiredDescription
urlstringYesThe website, e.g. yourbakery.com

Details

From the project README

everthread

A website security check that explains itself in plain English. Free, no key, observation only.

npx everthread check yourbakery.com

EverThread · yourbakery.com
WORTH A LOOK  Nothing alarming, but one thing is worth fixing.

FIX THIS WEEK  Your site lets browsers fall back to an insecure connection
  The Strict-Transport-Security header is not being sent. ...
  Fix: Send the technical line below to whoever runs your site. ...
  • One fresh check per site per week. Inside that week you get the stored result, its age, and a note about daily watching.
  • --json for machines, --fail-on urgent (or attention) to fail a CI step.
  • everthread explain tls.expiring and everthread findings for the explanations behind every finding.

As an MCP server

{ "mcpServers": { "everthread": { "command": "npx", "args": ["-y", "everthread", "mcp"] } } }

Tools: check_site, explain_finding, list_findings. Works with Claude Code, Claude Desktop, Cursor, and anything else that speaks MCP.

What it does and doesn't do

It loads the home page the way a browser does and reads the certificate, security headers, scripts, forms, frames, redirects, a fixed handful of well-known files, and the page text. It never logs in, probes for hidden paths, or runs exploit tooling. Public results withhold the exact address of an exposed file; the site owner sees it after signing up. Only check sites you own or have permission to check.

Docs: https://everthread.live/api · Every finding explained: https://everthread.live/fix/

MCP Badge

Comments

Markdown supported

New to MCP?

From what the protocol is to installing your first server, these answers cover most first questions.

An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.