API & MCP
Security grades, exposed software, known and actively exploited CVEs, and 10-second uptime, through a REST API and an MCP server. Stop a deploy that ships a vulnerability. Ask Claude which sites are exposed. Pause alerts while you ship.
Keys on every plan · Talk to sales about Enterprise limits
> do any of my sites run software with an actively exploited CVE?
⏺ internetsecure - list_monitors (MCP)
⎿ 14 monitors · 1 with Exposure F
⏺ internetsecure - get_security_result (MCP)
⎿ shop.example.com
⏺ One. shop.example.com runs WordPress 6.4.2: end of life, with 2 actively exploited CVEs (Exposure F). Updating WordPress clears both. Every other site is Exposure A or better.
> tell me in Slack if that gets worse
⏺ internetsecure - get_account (MCP)
⎿ Slack: not connected
⏺ Slack isn't connected yet. Connect it at internetsecure.org/account/profile?panel=slack, then I can turn Slack alerts on for shop.example.com.
> and is anything down right now?
⏺ No. All 14 uptime monitors are up.
01
One step in any pipeline. The scan runs the same 13 security checks and the same exposure matching as the dashboard: the software and versions your site discloses, checked against end-of-life dates and known CVEs, with actively exploited ones flagged. Fail the build below a B, or on any actively exploited CVE. 2 to 10 seconds; failed scans don't use quota.
- name: Security gate
run: |
curl -sf -X POST https://internetsecure.org/api/v1/scans \
-H "Authorization: Bearer ${{ secrets.ISEC_KEY }}" \
-d '{"domain": "example.com", "min_grade": "B"}' \
| jq -e '.gate.passed and
([.exposure.findings[].known_exploited] | add // 0) == 0'02
Connect Claude Code, Cursor, VS Code or Claude Desktop with one line. It reads your grades, exposure findings and uptime, runs scans, and with a full-access key adds and changes monitors (it asks you first). It tells you which integrations are connected and where to connect the rest.
claude mcp add --transport http internetsecure \ https://internetsecure.org/mcp \ --header "Authorization: Bearer isk_…"
03
List monitors with security grade, exposure grade, uptime and open incidents. Add a domain. Turn alert channels on per monitor. Pause uptime alerts during a deploy and resume after. Every response is JSON, every error a plain sentence.
# pause uptime alerts while you ship, resume after
curl -X PATCH https://internetsecure.org/api/v1/monitors/48213 \
-H "Authorization: Bearer $ISEC_KEY" -d '{"uptime": false}'
./deploy.sh
curl -X PATCH https://internetsecure.org/api/v1/monitors/48213 \
-H "Authorization: Bearer $ISEC_KEY" -d '{"uptime": true}'An assistant with your key can only do what the key allows, and you can see and undo all of it.
Read-only keys
Tick one box: the key can read and scan, and gets a 403 on any change.
No deleting
Removing a monitor only happens on the website, by a person.
Undo in the Activity Log
Every change made with a key is logged with who, what and when, and can be undone in one click.
Website text kept short
Anything a scanned site controls (headers, software names, versions) is cut to one short line and marked as data, so a hacked site can't plant instructions for your AI.
The API reads the same monitoring as the dashboard. Nothing is sampled or cached for it.
~10 sec
check interval
6
locations, 3 must agree
13
security checks per scan
CVE + KEV
exposure, updated every 2 h
| Plan | Price | Requests a minute | Scans a day |
|---|---|---|---|
| Free | $0 | 60 | 10 |
| Plus | $5 a month | 120 | 100 |
| Pro | $20 a month | 300 | 500 |
| Enterprise | $149 a month | 600 | 2,000+ |
Start the trial, create a read-only key, paste one line.