Help center

API and MCP

API keys with scopes, the REST API, the MCP server at nhmohio.com/api/mcp with 177 tools for Claude and other clients, guided onboarding, agent verification and scanner reports.

Updated · 8 articles

Pro reads its own data over the API and MCP; Enterprise also writes. Both use the same nhm_ keys, scoped to the resources you choose, and the plan is re-read on every request.

Articles

  • API keys - scopes, the write scope, expiry, the hourly rate limit, the ten-key limit, and usage.
  • The REST API - base URL, bearer authentication, the domain check endpoint, and the error codes you will meet.
  • Connecting the MCP server - Claude Code, Claude Desktop and any HTTP MCP client; confirming what a key can reach; the prompts the server carries.
  • MCP tool reference - every tool a customer key can be offered, by scope, with its access level.
  • Guided onboarding and playbooks over MCP - adding a domain by answering questions, setting up Local SEO, and the review and triage playbooks.
  • Build your WISP with an AI assistant - the assistant interviews you and hands you a finished written information security plan as a Word document.
  • Let your AI agent check our work - connect an agent in two clicks; it re-tests every finding with read-only checks and tells us what we got wrong (Pro and Enterprise).
  • Reporting scanner mistakes - how a connected assistant tells NHM when the scanner is wrong (Pro and Enterprise).

Plans

Plan API and MCP
Free, Starter None; the endpoints answer 401
Pro Read: every tool that reads stored data, across the scopes you grant
Enterprise Read and write: start scans, spend credits, change saved data; all 233 customer tools

Which one should I use?

  • A script or an integration (a spreadsheet that pulls certificate expiry dates, a ticketing system that opens a ticket on a high finding): the REST API with a read key on Pro, or a write key on Enterprise.
  • An assistant (Claude Code, Claude Desktop, or any MCP client): the MCP server, which exposes the same data as tools with descriptions the assistant can read, plus prompts for the common jobs.
  • Nothing scripted: the dashboard and the app do everything the API does, and scanning from them stays free on every plan. What the paid plans buy is scripted access.

The rules both share

  • The key is scoped; tools and routes outside its scopes are refused.
  • Anything that changes state, spends, or runs a live lookup needs the write scope, which only Enterprise can mint. Over REST that means every non-GET call plus the GET routes that scan live, such as /api/checkup and /api/seo-check.
  • The REST API reaches a narrower set of routes than MCP; see the REST API for the list.
  • The plan is re-read on every request.
  • Every call goes through the same ownership checks the dashboard uses.

In reading order

Articles in API and MCP

  1. API keysCreate scoped nhm_ keys under Settings: resource scopes, the Enterprise-only write scope, optional expiry, the hourly rate limit, ten active keys, and usage.Updated
  2. The REST APIBase URL, bearer authentication with an nhm_ key, the routes a key can reach and the scope each needs, which calls need write, and the 401, 402, 403 and 429 replies.Updated
  3. Connecting the MCP serverAdd https://nhmohio.com/api/mcp to Claude Code, Claude Desktop, Cursor, VS Code, Codex or any HTTP MCP client with an nhm_ key, keep the key to the job, confirm what it can reach, and use the prompts.Updated
  4. MCP tool referenceAll 233 tools a customer key can be offered, by scope, with each one's access level. 125 read, 99 write, 9 destructive; 7 spend credits.Updated
  5. Guided onboarding and playbooks over MCPAdd a domain by answering questions, set up Local SEO with a quoted first measurement, and the review, triage and deliverability playbooks an assistant follows.Updated
  6. Build your WISP with an AI assistantConnect Claude to DomainGuard and it interviews you, then hands you a finished written information security plan as a Word document.Updated
  7. Let your AI agent check our workConnect Claude or another agent in two clicks. It re-tests what DomainGuard found with read-only DNS, HTTPS and TLS checks, sends each verdict back, and tells you what was right and wrong.Updated
  8. Reporting scanner mistakesHow a connected assistant tells NHM when the scanner is wrong: reports collect into a per-domain review and are sent as one message. Pro and Enterprise, 30 a day.Updated

Still stuck?

Ask the people who run the scanner.

Send the domain and what you expected to see. We look at the same scan you are looking at and write back with what it means and what to change.

Contact supportCall (330) 305-2750