Scan for free

Hullwise from your code or your AI assistant

The API and the MCP server check exactly like the scan on the homepage. They request the page once and load the JavaScript files the page includes itself. On top of that come a TLS handshake and SPF and DMARC from public DNS. You get the same grade, the same 63 checks and the same findings, only as JSON. Every finding carries a stable ID your code can branch on.

REST API · JSON in and out
https://hullwise.co/api/v1
MCP server · Streamable HTTP
https://hullwise.co/mcp

  1. Get a key

    The REST API requires an API key. You create one in your account under API keys. For a first try, the test key sc_test_demo works too. How to send it is described under Authentication.

    Terminal
    export HULLWISE_API_KEY="sc_live_…"

  2. Check your first site

    Send a GET request with the address as a parameter. The response usually arrives within a few seconds.

    Terminal
    curl "https://hullwise.co/api/v1/scan?url=example.com" \
  -H "Authorization: Bearer $HULLWISE_API_KEY"

    The API reference explains every field in the response.

  3. Or connect an AI assistant

    The MCP server works without a key. Without one, you get 20 checks per hour per IP address. In Claude Code, a single line is enough.

    Terminal
    claude mcp add --transport http hullwise https://hullwise.co/mcp

    Setup guides for Claude, ChatGPT, Codex, Cursor and VS Code are under MCP.

Full reports with Business

Without a paid plan, the server shortens the report. The grade, the score and the number of findings are always included, but only the two most urgent findings come in full. The rest carry locked: true and arrive without an ID or text. This applies to the free key, the test key and the MCP server without a key. With a key from an account on Business, the API and MCP return the complete report. The details are under Shortened reports.

What a check returns

The checks are sorted into six groups. The number next to each group is how many checks with their own ID it contains.

Encryption and certificate6Whether your site is reachable over an encrypted connection and the certificate is valid, the padlock in the browser. If either is missing, third parties can read along or visitors see a warning page.Browser security settings9House rules your server sends to the browser with every response, for example: do not run scripts from elsewhere. Without them, the browser also runs injected code.Protection against spoofed email6Whether a record at your domain provider defines who may send email in your name. Without it, fake invoices with your sender address get through more easily.Domain and DNS5Public records of your domain: whether a dangling redirect hands your address to strangers, who may issue certificates, whether DNSSEC is active and where security researchers can report vulnerabilities.Outdated software2Components of your site in versions with publicly known vulnerabilities.Source code and JavaScript files28What any visitor can read in the source and JavaScript files of your app, for example keys for databases, AI services or payments.Data protection (GDPR)5Common data protection mistakes that can be proven from the outside and often lead to legal warnings in Germany: Google Fonts from Google's servers, tracking before consent, embedded content and missing mandatory links. Not legal advice.Cookies2Whether the cookies on your site are protected against eavesdropping and third-party scripts.

For agents reading this

Only check sites the person owns or is authorized to test. See the acceptable use policy.

Is your app
watertight?

Hullwise finds the leaks before someone else does: exposed keys, database credentials and outdated software. Every finding comes with steps to fix it.

https://

Click a finding to mark it as fixed.

See pricingHow a scan works

Ship fast. Stay hullwise.