everthread
Official# everthread
A website security check that explains itself in plain English. Free, no key, observation only.
```
npx everthread check yourbakery.com
```
```
EverThread · yourbakery.com
WORTH A LOOK Nothing alarming, but one thing is worth fixing.
FIX THIS WEEK Your site lets browsers fall back to an insecure connection
The Strict-Transport-Security header is not being sent. ...
Fix: Send the technical line below to whoever runs your site. ...
```
- One fresh check per site per week. Inside that week you get the stored result, its age, and a note about daily watching.
- `--json` for machines, `--fail-on urgent` (or `attention`) to fail a CI step.
- `everthread explain tls.expiring` and `everthread findings` for the explanations behind every finding.
## As an MCP server
```json
{ "mcpServers": { "everthread": { "command": "npx", "args": ["-y", "everthread", "mcp"] } } }
```
Tools: `check_site`, `explain_finding`, `list_findings`. Works with Claude Code, Claude Desktop, Cursor, and anything else that speaks MCP.
## What it does and doesn't do
It loads the home page the way a browser does and reads the certificate, security headers, scripts, forms, frames, redirects, a fixed handful of well-known files, and the page text. It never logs in, probes for hidden paths, or runs exploit tooling. Public results withhold the exact address of an exposed file; the site owner sees it after signing up. Only check sites you own or have permission to check.
Docs: https://everthread.live/api · Every finding explained: https://everthread.live/fix/
[](https://lobehub.com/mcp/pb-digital-llc-everthread-cli)
TDQS
Scored across 3 tools
check_site (run a scan), list_findings (enumerate all finding types), and explain_finding (deep-dive on one type) target distinct needs, and the description explicitly tells the agent to use list_findings for type names. The only mild overlap is between list_findings and explain_finding, both of which concern finding types, but their granularity (catalog vs. single explanation) keeps them separable.
All three names follow a clean verb_noun snake_case pattern: list_findings, check_site, explain_finding. No casing or verb-style mixing, and each name is self-descriptive.
Three tools is lean but defensible for a focused security-check service: one action, one catalog, one explainer. It sits just under the comfortable range, as there is no room for managing or revisiting checks, but nothing is redundant.
The surface covers running a check and interpreting results, but has notable gaps: no tool to list previously checked sites or retrieve past/historical results, and despite the description touting a free daily watch, no tool exposes enabling or managing that monitoring. Agents can work around these for a one-off scan but hit a dead end for lifecycle/tracking workflows.