How do I install EverThread?

Copy the stdio config for Cursor, Claude Desktop, Claude Code, or VS Code on this page. It uses the publisher's install, not a PlugMCP proxy.

Does EverThread need an API key?

No required environment variable is listed on this record.

What transport does EverThread use?

EverThread runs locally over stdio.

EverThread

Q: When was EverThread last checked?

Last checked 2026-10-16. Plain-English website security check for agents: certificate, headers, scripts, forms, spam.

by io.github.PB-Digital-LLC

Plain-English website security check for agents: certificate, headers, scripts, forms, spam.

Power your agent

Add this server

The publisher's own command. Not a PlugMCP endpoint.

Local command

npx -y [email protected]

Provider

Claude Code

claude mcp add io.github.pb-digital-llc-everthread -- npx -y [email protected]

Run in a terminal.

Claude Desktop

{
  "mcpServers": {
    "io.github.pb-digital-llc-everthread": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ]
    }
  }
}

claude_desktop_config.json

Step-by-step: add this in Claude

Remote URL or a command on your machine? How the two installs differ

Run on PlugMCP

Host a copy with our keys and logs.

A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.

Launch

Related MCP

Related skills

View all

everthread

A website security check that explains itself in plain English. Free, no key, observation only.

npx everthread check yourbakery.com

EverThread · yourbakery.com
WORTH A LOOK  Nothing alarming, but one thing is worth fixing.

FIX THIS WEEK  Your site lets browsers fall back to an insecure connection
  The Strict-Transport-Security header is not being sent. ...
  Fix: Send the technical line below to whoever runs your site. ...

One fresh check per site per week. Inside that week you get the stored result, its age, and a note about daily watching.
--json for machines, --fail-on urgent (or attention) to fail a CI step.
everthread explain tls.expiring and everthread findings for the explanations behind every finding.

As an MCP server

{ "mcpServers": { "everthread": { "command": "npx", "args": ["-y", "everthread", "mcp"] } } }

Tools: check_site, explain_finding, list_findings. Works with Claude Code, Claude Desktop, Cursor, and anything else that speaks MCP.

What it does and doesn't do

It loads the home page the way a browser does and reads the certificate, security headers, scripts, forms, frames, redirects, a fixed handful of well-known files, and the page text. It never logs in, probes for hidden paths, or runs exploit tooling. Public results withhold the exact address of an exposed file; the site owner sees it after signing up. Only check sites you own or have permission to check.

Docs: https://everthread.live/api · Every finding explained: https://everthread.live/fix/