Claude connector & API
Use it in Claude
Last updated October 2026
The Small Business Security Check connector lets Claude run our passive security checks on a small business's website, email domain and DNS, explain every issue in plain English, and walk you through the fix. It only looks at publicly observable information — the same things any visitor can see — and never changes anything.
What you need and pricing
- A Claude account on any plan that supports connectors.
- A Small Business Security Check API key with runs. One key holds both kinds below.
| Runs | Price | Per run | Discount |
|---|---|---|---|
| 1–99 runs | $7 each | $7.00 | No discount |
| 100 runs | $400 | $4.00 | 42% off |
| 500 runs | $1,500 | $3.00 | 57% off |
| 1,000 runs | $2,500 | $2.50 | 64% off |
| 5,000 runs | $5,000 | $1.00 | 85% off |
| 10,000 runs | $7,500 | $0.75 | 89% off |
| Runs | Price | Per run | Discount |
|---|---|---|---|
| 1–100 runs | $20 each | $20.00 | No discount |
| 250 runs | $3,750 | $15.00 | 25% off |
| 500 runs | $6,000 | $12.00 | 40% off |
| 1,000 runs | $10,000 | $10.00 | 50% off |
| 5,000 runs | $37,500 | $7.50 | 62% off |
| 10,000 runs | $50,000 | $5.00 | 75% off |
- A website scan, DNS & domain recon or WordPress check uses 1 scan run. A Knock Knock Full Digital Footprint uses 1 Knock Knock run. Checking your balance and the advice tools are free.
- In Claude, a Knock Knock run returns its findings in the chat. It includes everything a website scan checks, but not the storefront's downloadable report.
- Runs are good for 12 months from your key's latest purchase.
- Your key is shown right after checkout.
Connect it in Claude
- In Claude, open Settings → Connectors (or Customize → Connectors) and
find Small Business Security Check in the directory, or choose Add custom
connector and enter this URL:
Connector URL https://www.smallbizsecuritycheck.com/mcp
- Click Connect. On the Small Business Security Check sign-in page, paste your API key, confirm you'll only scan domains you own or are authorized to assess, and click Connect.
- Ask Claude something like the examples below.
Claude Code
claude mcp add --transport http sbsc https://www.smallbizsecuritycheck.com/mcp --header "Authorization: Bearer YOUR_API_KEY"
Your own MCP client or script
Send the key as Authorization: Bearer sbsc_... (or x-api-key)
to the connector URL above. It speaks Streamable HTTP with JSON responses. For example, to
list the tools:
curl -s \
https://www.smallbizsecuritycheck.com/mcp \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json" \
-H "Accept: application/json, text/event-stream" \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'Example prompts
Replace [your-domain.com] with a domain you own or are authorized to
assess.
Scan my website, [your-domain.com], and tell me the three most urgent things to fix.
Can criminals send email pretending to be from my domain, [your-domain.com]? Run a DNS & domain recon and give me the exact DNS records to add.
Check my WordPress site, [your-domain.com], for outdated plugins with known vulnerabilities.
Run a Knock Knock Full Digital Footprint on my company's domain, [your-domain.com], and tell me what an attacker could learn about us.
Write a one-page incident response plan for Smith Dental, then tell me how ready we are for cyber insurance.
How many runs do I have left?
Tools and what they cost
| Tool | What it does | Cost |
|---|---|---|
scan_website | Website security scan | 1 scan run |
dns_domain_recon | DNS & domain recon | 1 scan run |
full_recon | Knock Knock Full Digital Footprint | 1 Knock Knock run |
wordpress_recon | WordPress security check | 1 scan run |
check_run_balance | Check runs left | Free |
generate_fix | Step-by-step fix for a finding | Free |
risk_score | Combine findings into a risk score | Free |
plain_english_report | Write an owner-friendly report | Free |
incident_plan_generator | One-page incident response plan | Free |
insurance_readiness_report | Cyber-insurance readiness check | Free |
client_questionnaire_answers | Draft security questionnaire answers | Free |
backup_posture_check | Backup and ransomware readiness questionnaire | Free |
mfa_coverage_check | MFA coverage questionnaire | Free |
access_privilege_review | Account access review questionnaire | Free |
A scan that can't be performed is never charged: the domain doesn't resolve, the site can't be reached, none of its checks could run, it takes longer than 90 seconds (150 for the Full Digital Footprint), or the scanner is busy. Each paid scan appears as a tool call you can approve; keep approval on in Claude's connector settings.
Each API key can run up to 60 scans an hour, or 1 an hour for every 20 runs it has bought if that's more, up to 600 (a 10,000-run pack: 500 an hour). A scan over the limit isn't run or charged, and the message says when you can scan again.
Rules
Only scan domains you own or are authorized to assess
You agree to this when you connect your key in Claude. Every paid scan also needs
authorized: true, which Claude sends only once you've told it you own the
domain or are authorized to assess it; Claude Code, API and script callers send it
themselves, under the same rule. We log the domain, tool and time of each authorized scan
(kept 30 days).
Scans are passive: no port scanning, no logins, no password guessing, no exploits. Look-alike domains a recon finds are listed to watch, not to scan: they usually belong to someone else.
Troubleshooting
- "That API key wasn't recognized"
- Paste the whole key, starting with
sbsc_, with no spaces. - "No scan runs left" or "No Knock Knock runs left"
- Add runs to your key: paste your key in the "Adding to a key" box. The two kinds are separate balances, so buy the kind the message names.
- "Before scanning, ask the user to confirm…"
- Tell Claude you own the domain or are authorized to assess it.
- Claude keeps asking you to sign in
- Disconnect and reconnect the connector in Claude's settings, then paste your key again.
- "The scanner is busy"
- Wait a minute and ask again; no run was used.
- "This API key has reached its limit of … scans an hour"
- Scan again after the time it gives; no run was used.
- Lost your key
- Email smallbizsecuritycheck@gmail.com with your Stripe receipt.
Privacy and support
See our Privacy Policy and Terms. The connector receives only the tool inputs Claude sends (such as the domain to scan), never your conversation.
To scan a domain we look it up through public DNS-over-HTTPS resolvers (Google Public DNS, with Cloudflare as a fallback). A DNS & domain recon also searches public certificate-transparency logs for it (crt.sh, when it's reachable) and looks up a few dozen look-alike spellings of it the same way. A Knock Knock Full Digital Footprint does the same, looks up about 1,000 common subdomain names under it, and looks up the network that hosts its website in Team Cymru's public IP-to-network registry (also through DNS).
Your key's record (a hash of the key, its runs and usage, and the purchase email) is kept until you ask us to delete it. Support: smallbizsecuritycheck@gmail.com.