English Français العربية

EverThread

Official registry Security

Plain-English website security check for agents: certificate, headers, scripts, forms, spam.

Source code Website Documentation

Install

Add this to your client's MCP configuration (Claude Desktop: claude_desktop_config.json; Cursor: .cursor/mcp.json; VS Code and others use the same "mcpServers" shape).

NPM package everthread
Claude Code 
claude mcp add everthread -- npx -y everthread@0.1.3 mcp
JSON configuration (Claude Desktop, Cursor, VS Code) 
{
    "mcpServers": {
        "everthread": {
            "command": "npx",
            "args": [
                "-y",
                "everthread@0.1.3",
                "mcp"
            ]
        }
    }
}

Documentation

From the project's README on GitHub, refreshed weekly. Links open on GitHub.

everthread

A website security check that explains itself in plain English. Free, no key, observation only.

npx everthread check yourbakery.com
EverThread · yourbakery.com
WORTH A LOOK  Nothing alarming, but one thing is worth fixing.

FIX THIS WEEK  Your site lets browsers fall back to an insecure connection
  The Strict-Transport-Security header is not being sent. ...
  Fix: Send the technical line below to whoever runs your site. ...
  • One fresh check per site per week. Inside that week you get the stored result, its age, and a note about daily watching.
  • --json for machines, --fail-on urgent (or attention) to fail a CI step.
  • everthread explain tls.expiring and everthread findings for the explanations behind every finding.

As an MCP server

{ "mcpServers": { "everthread": { "command": "npx", "args": ["-y", "everthread", "mcp"] } } }

Tools: check_site, explain_finding, list_findings. Works with Claude Code, Claude Desktop, Cursor, and anything else that speaks MCP.

What it does and doesn't do

It loads the home page the way a browser does and reads the certificate, security headers, scripts, forms, frames, redirects, a fixed handful of well-known files, and the page text. It never logs in, probes for hidden paths, or runs exploit tooling. Public results withhold the exact address of an exposed file; the site owner sees it after signing up. Only check sites you own or have permission to check.

Docs: https://everthread.live/api · Every finding explained: https://everthread.live/fix/

Frequently asked questions

What is EverThread?

Plain-English website security check for agents: certificate, headers, scripts, forms, spam.

How do I install EverThread?

It runs on your machine. In Claude Code: claude mcp add everthread -- npx -y everthread@0.1.3 mcp. For other clients, paste the JSON configuration from this page into their MCP settings.

Does EverThread need an API key?

Its registry entry lists no required key or secret. Some features may still need an account with the service it connects to.

Is EverThread open source?

Yes. Its code is on GitHub under the MIT license.

Who maintains EverThread?

It is published by PB-Digital-LLC. AI.tn lists it but does not maintain or endorse it.

From the official MCP Registry. Listing is not an endorsement: review a server's code and permissions before giving it access to your data.