Performs plain-English website security audits covering certificates, headers, scripts, forms, and spam detection.
Also known as PB-Digital-LLC/everthread-cli, everthread-cli
- Stars
- 0
- Tools
- —
- Downloads, 30 days
- —
- Latest version
- 0.1.3
- Last commit
- Sep 27, 2026
- License
- MIT
What is EverThread MCP?
EverThread performs plain-English website security audits covering certificates, headers, scripts, forms, and spam detection.
Summary generated from the project's README
About EverThread MCP server
EverThread provides website security audits that translate technical vulnerabilities into plain English. It analyzes a site by loading the homepage like a browser to inspect SSL certificates, security headers, scripts, forms, frames, and redirects. This tool is designed for observation only and does not perform active probing, login attempts, or exploit testing. It is free to use and requires no API keys for standard checks.
Developers can integrate this server into MCP clients like Claude Desktop, Claude Code, or Cursor using the npx command. The server provides three specific tools: check_site, explain_finding, and list_findings. It operates with a limit of one fresh check per site every week, though users can access stored results within that timeframe. For automated workflows, the CLI supports a JSON output mode and a flag to fail CI steps when urgent issues are detected.
What you can do with it
- 1Interpreting complex security vulnerabilitiesAsk an AI client to provide a human-readable explanation for a specific technical finding like an expiring TLS certificate.
- 2Performing periodic website health checksRun a security scan on a domain to check for missing security headers or insecure connection fallbacks.
Written from the project's README. Every use case is checked against a quote from it.
How to install EverThread MCP
Formats verified 10 Nov 2026Add to CursorAdd to GooseInstall EverThread MCP in Claude Code
$ claude mcp add everthread-cli -- npx -y everthreadInstall EverThread MCP in Cursor
~/.cursor/mcp.json
{
"mcpServers": {
"everthread-cli": {
"command": "npx",
"args": [
"-y",
"everthread"
]
}
}
}Install EverThread MCP in VS Code
.vscode/mcp.json
{
"servers": {
"everthread-cli": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"everthread"
]
}
}
}Install EverThread MCP in VS Code CLI
$ code --add-mcp '{"name":"everthread-cli","type":"stdio","command":"npx","args":["-y","everthread"]}'Install EverThread MCP in Claude Desktop
claude_desktop_config.json
{
"mcpServers": {
"everthread-cli": {
"command": "npx",
"args": [
"-y",
"everthread"
]
}
}
}Install EverThread MCP in Codex
$ codex mcp add everthread-cli -- npx -y everthreadInstall EverThread MCP in Codex config.toml
~/.codex/config.toml
[mcp_servers.everthread-cli] command = "npx" args = ["-y", "everthread"]
Install EverThread MCP in Gemini CLI
$ gemini mcp add -s user everthread-cli npx -- -y everthreadInstall EverThread MCP in Gemini settings.json
~/.gemini/settings.json
{
"mcpServers": {
"everthread-cli": {
"command": "npx",
"args": [
"-y",
"everthread"
]
}
}
}Automated checks
Ran Nov 15, 2026Full report →Passed our automated checks. That is not a security audit: read the code and give the server the narrowest access it needs. How checks work
- Source repository linked and reachablepb-digital-llc/everthread-cli is public and reachablegithub.com/pb-digital-llc/everthread-cli ↗Pass
- Package names this repository as its sourceeverthread names pb-digital-llc/everthread-cli as sourcenpmjs.com/package/everthread ↗Pass
- Build provenance (Sigstore attestation)No build attestation published for this releaseNot checked
- Open source license (OSI)MITspdx.org/licenses/MIT.html ↗Pass
- Commit or release in the last yearLast commit or release 2026-09-27github.com/pb-digital-llc/everthread-cli ↗Pass
- OpenSSF ScorecardNot checked
- Package name not close to a popular packageNo popular package one edit away from everthreadPass
- No critical advisory in the package or its dependencies99 resolved dependencies checked; no critical advisoryosv.dev ↗Pass
- No hidden instructions to the model0 tool descriptions and the README read; no override phrases, credential paths or hidden charactersPass
- Destructive tools are labelledNot checked
- Remote endpoint answers the MCP handshakeNot checked
README
View on GitHubeverthread
A website security check that explains itself in plain English. Free, no key, observation only.
npx everthread check yourbakery.com
EverThread · yourbakery.com
WORTH A LOOK Nothing alarming, but one thing is worth fixing.
FIX THIS WEEK Your site lets browsers fall back to an insecure connection
The Strict-Transport-Security header is not being sent. ...
Fix: Send the technical line below to whoever runs your site. ...
- One fresh check per site per week. Inside that week you get the stored result, its age, and a note about daily watching.
--jsonfor machines,--fail-on urgent(orattention) to fail a CI step.everthread explain tls.expiringandeverthread findingsfor the explanations behind every finding.
As an MCP server
{ "mcpServers": { "everthread": { "command": "npx", "args": ["-y", "everthread", "mcp"] } } }
Tools: check_site, explain_finding, list_findings. Works with Claude Code, Claude Desktop, Cursor, and anything else that speaks MCP.
What it does and doesn't do
It loads the home page the way a browser does and reads the certificate, security headers, scripts, forms, frames, redirects, a fixed handful of well-known files, and the page text. It never logs in, probes for hidden paths, or runs exploit tooling. Public results withhold the exact address of an exposed file; the site owner sees it after signing up. Only check sites you own or have permission to check.
Docs: https://everthread.live/api · Every finding explained: https://everthread.live/fix/
EverThread MCP questions
How do I add EverThread MCP to Claude Code?
Run claude mcp add everthread-cli -- npx -y everthread in your terminal. Add --scope user to make it available in every project.
How do I add EverThread MCP to Cursor?
Open ~/.cursor/mcp.json and add the server under mcpServers, using the Cursor config shown in the install section above.
Does EverThread require an API key?
No, the service is free and does not require a key for observation.
Can I use EverThread in a CI/CD pipeline?
Yes, you can use the --fail-on flag to trigger failures in CI steps based on urgent or attention-required findings.
What specific security elements does it check?
It examines certificates, security headers, scripts, forms, frames, redirects, and specific well-known files.
Does EverThread perform active penetration testing?
No, it only performs observation and does not log in, probe for hidden paths, or run exploit tools.