Build with Blockquote

An API key is a bearer token that starts with bq_ and authenticates every REST and MCP call as your account. Keys are self-serve: open the account page, create a key, and copy the value — it is shown exactly once and cannot be read again. An account holds at most 5 keys you create yourself. Each key is created with a fixed scope: reports only, scans and reports (the default), or scans, reports and monitors. The scope stays fixed for the life of the key, and you revoke a key from the same page at any time.

API keys are a paid feature. The free plan carries no API keys; the Pro and Agency plans carry them. Sending a valid key switches metering from the anonymous per-IP limits to your plan's quotas, unlocks the complete fix list in every report view, and enables refresh, which skips the 24-hour report cache. The account page is also where you read the plan you are on and the scans it has spent. Plan prices and the right of withdrawal live on the pricing section and the refunds page, not here.

A full scan, scored, with no account at all. Anonymous callers get 1 scan per day and 3 scans per month from one network address, over the website, the REST API and the MCP endpoint alike — one budget, three front doors. The report is the anonymous tier: the 0–100 score, all 34 check results, and the top 1 recommendation, with the rest of the fix list locked.

That is deliberately the lowest hurdle the product can offer: a script or an agent produces a scored report before anyone signs anything. Hitting a limit returns a structured error carrying the retry delay, so a well-behaved caller backs off exactly as long as it needs to. There is no CAPTCHA on the MCP path, because human-verification widgets are unsolvable for headless callers by design — the relay authenticates itself and forwards your network address for metering. Anonymous POST /api/scan over plain REST does need a Cloudflare Turnstile token, so a headless REST caller scans over MCP or with a key on a paid plan.

In three places, each written for a different reader. /api/v1/docs is the reference UI: every route, every parameter, and a request builder that runs in the browser. /api/v1/openapi.json is the document behind that UI, an OpenAPI 3.1 description of the whole /api surface, which you hand to a code generator or to an agent. /docs/ai-agents is the MCP side: the endpoint URL, a setup block per client, the sixteen tools, the two prompts, the three resources, and the full connection FAQ.

The OpenAPI document is hand-authored, and a test fails the build when the document and the router disagree in either direction — so the description matches the running code rather than trailing it. Start at the reference UI, switch to the raw document once you generate a client, and read the agent page when your caller is an AI agent rather than a script.

Two shapes. Over REST, POST /api/scan starts a scan and returns an id, GET /api/scan/{id} polls it, and that same route with the header Accept: text/markdown returns the finished report as one Markdown document instead of JSON. POST /api/scan needs a key on a paid plan or a Cloudflare Turnstile token. A key whose account has lapsed to Free still authenticates the call, but it does not skip the token. GET /api/scan/{id} reads any finished scan anonymously. Over MCP, point any client at https://mcp.blockquote.io/mcp and call start_scan, then get_scan. An MCP call needs neither a key nor an account. The first block below is plain JSON-RPC against the MCP endpoint plus the one-line Markdown read; the second is the config file Cursor and VS Code read.

Every current MCP client connects with a URL alone, because the server follows the Streamable HTTP transport of the MCP specification and keeps no session state. Claude Code takes one command. Add the Authorization header only when you want the call to run as your account rather than anonymously.