API and AI assistants

What this is for

An app that goes live with an exposed key is vulnerable from the first minute. That is why the same check also runs without a browser: from your own code, in an automated pipeline before every release, or through an AI assistant that suggests the fix along with the result. It checks the same things as the website. Every finding has a fixed identifier such as header.csp.missing that programs can react to. A pipeline can, for example, stop as soon as a finding starting with code.secret shows up.

This is the short version. Everything else for developers is in the developer docs.

AI assistants

AI assistants such as Claude, ChatGPT or Cursor can connect tools through an open standard called the Model Context Protocol, or MCP. You add the Hullwise address to your assistant once. After that you can write, for example:

Check your-company.com with Hullwise and tell me which headers I need to add to vercel.json.

The assistant starts the check, reads the result and explains it to you. Hullwise offers two tools for this. scan_website checks a site, list_checks lists what a check looks at and what it never does. Both only read and change nothing. You don’t need an account for this. With an API key, your higher limit applies. How to add Hullwise to your assistant is described step by step in MCP server.

REST API

For your own programs there is an HTTP interface. You need an API key from your account. We store only a fingerprint of the key, not the key itself. If you lose it, we can’t show it to you again. So store it in your pipeline’s protected settings, never in code.

curl "https://hullwise.co/api/v1/scan?url=your-company.com" \
  -H "Authorization: Bearer sc_live_…"

The response contains the grade, the score and all findings. Every field is explained in the developer docs.

Limits

The REST API always requires a key, so at least a free account. Once you reach your limit, wait until the next hour.

Still have questions? Email us.