Connect ContentMas to your tools

Create a key in Dashboard → Settings → Connections. Keys start with cm_live_ and are shown once; we store only a hash. You can have up to five active keys and revoke any of them at any time. Send the key on every request:

Authorization: Bearer cm_live_…

A missing, revoked or unknown key gets 401. Keep keys secret: anyone holding one can run audits as you.

A remote MCP server (Streamable HTTP, protocol version 2025-06-18) at:

https://contentmas.com/api/mcp

Claude Code:

claude mcp add --transport http contentmas https://contentmas.com/api/mcp --header "Authorization: Bearer <your-api-key>"

Cursor and other clients that take a JSON config with headers:

{
  "mcpServers": {
    "contentmas": {
      "url": "https://contentmas.com/api/mcp",
      "headers": { "Authorization": "Bearer <your-api-key>" }
    }
  }
}

Tools:

• start_site_audit { url, type?, region? }

  Starts a site audit and returns its token.

• get_audit_status { token }

  Status, pages crawled and, once done, the overall and pillar scores.

• get_audit_report { token, pillar? }

  Pillar scores and the most important failing checks with their fixes.

• list_my_audits { limit? }

  Your recent audits with token, URL, status and score.

• start_code_audit { repo, siteAudit? }

  Starts a read-only code audit of a connected GitHub repository (owner/name) and returns its token.

• get_code_audit { token }

  Status, code score and the failing or partial checks with file:line evidence and fixes.

Audits take a few minutes. Ask your assistant to start one, check its status, then read the report.

JSON in, JSON out, base URL https://contentmas.com/api/v1. Errors are { "error": "…" } with the matching HTTP status. CORS is open, since only the key authenticates.

• POST /api/v1/site-audits

  Start a site audit. Body: { "url": "https://example.com", "type"?: "saas", "region"?: "eu" }. Returns 201 with the token.

• GET /api/v1/site-audits/:token

  Status, pillarScores and the report (applicable checks only) of one of your audits.

• GET /api/v1/site-audits?limit=20

  Your most recent audits, summaries only (limit 1 to 100).

• POST /api/v1/code-audits

  Start a code audit of a connected GitHub repository. Body: { "repo": "owner/name", "siteAudit"?: "<site audit token>" }. Returns 201 with the token.

• GET /api/v1/code-audits/:token

  Status, score and report (checks with redacted evidence) of one of your code audits.

• GET /api/v1/code-audits?limit=20

  Your most recent code audits, summaries only.

curl -X POST https://contentmas.com/api/v1/site-audits \
  -H "Authorization: Bearer <your-api-key>" \
  -H "Content-Type: application/json" \
  -d '{"url":"https://example.com"}'

curl https://contentmas.com/api/v1/site-audits/<token> -H "Authorization: Bearer <your-api-key>"

Poll the audit until status is done (or failed). type and region are optional; leave them out to auto-detect.

Connect GitHub in Dashboard → Settings → Connections to install the ContentMas GitHub App on the repositories you choose. The App is read-only: it has no write permissions and no webhooks, so it cannot change code, settings or issues. A code audit checks secrets and config (committed .env or key files, keys in source, .gitignore, secret scanning), dependencies (lockfiles, known vulnerabilities from Dependabot or OSV), CI and delivery (tests, scanners, branch protection, pinned actions, workflow permissions), common app security patterns and repo hygiene, and gives a 0–100 code score.

Permissions the App asks for (repository permissions only, all read-only):

• Contents: Read

  Read the file tree and selected files (config, server, auth, API routes, workflows, manifests and lockfiles).

• Metadata: Read

  Repository name, visibility, default branch and rulesets (always required).

• Administration: Read

  Branch protection of the default branch.

• Dependabot alerts: Read

  Open dependency vulnerability alerts.

• Secret scanning alerts: Read

  Open secret-scanning alerts (type and number only; never the secret).

• Actions: Read

  Workflow information.

• Pull requests: Read (optional)

  Reserved for pull-request checks; not required today.

Files are read in memory for the scan and discarded; only findings are stored (paths, line numbers and short snippets with secrets redacted). App security checks are static patterns: they report whether a pattern was found, not proof that the code is safe. Link a code audit to a site audit and its owner checks (for example ".env never committed" or "dependencies patched") show "Confirmed by GitHub scan" or the failing finding. Disconnect in Settings or uninstall the App on GitHub at any time.

Use the REST API from any step that can send HTTP requests: start an audit after a deploy, wait for it to finish, then fail the build or post a message if the overall score in score or a value in pillarScores drops below your threshold. Store the key as a secret in your CI or automation tool, never in code.

• 30 requests per minute per key, across the REST API and the MCP server.
• 20 new audits per day per account through the API.
• Pages per audit follow your plan, as in the dashboard.

Over a limit you get 429 with a Retry-After header. The API returns only your own results, the same as your dashboard.