Documentation

Using SecondDoor from code

Reading reports needs no key, and so does starting a basic scan, limited to eight per hour per address. Deep scans run on the paid plans and need a signed-in account. The full specification is at /openapi.json.

Scan a site

Start a scan, then poll until it finishes. A basic scan takes about 35 seconds.

curl -X POST https://your-seconddoor-host/api/scans \
  -H 'content-type: application/json' \
  -d '{"url": "https://example.com"}'

# {"scanId": "..."}

curl https://your-seconddoor-host/api/scans/{scanId}
# {"status": "completed", "reportSlug": "example-ab12cd"}

Read a report

Every report is available three ways: as a page, as JSON, and as markdown. The markdown version is the one to read if you are a language model.

curl https://your-seconddoor-host/api/reports/{slug}
curl https://your-seconddoor-host/r/{slug}.md

Scores, summaries and issue titles are always public. The evidence behind each score and the recommended fixes are behind a work email, and appear as a locked marker with a count until then.

Connect the MCP server

Three tools: get_report, run_scan and get_methodology. Stateless JSON-RPC over POST, no authentication.

{
  "mcpServers": {
    "seconddoor": {
      "type": "http",
      "url": "https://your-seconddoor-host/api/mcp"
    }
  }
}

The manifest is at /.well-known/mcp.json. To try it without a client:

curl -X POST https://your-seconddoor-host/api/mcp \
  -H 'content-type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

For language models

/llms.txt is the index of everything here.
/llms-full.txt is the entire scoring method in one fetch.
/methodology is the same thing as pages, one per dimension.