Docs / quickstart

Engineer first.
Verify last.

Turn the raw ask into an evidence-backed execution prompt, then verify the real artifact and downstream outcome instead of trusting a success response.

Add the remote MCP

No local package is required. Pick your client or automation environment.

macOSLinuxWindows

Run the same one-liner in macOS Terminal, a Linux shell, Windows PowerShell 7, or Command Prompt:

codex mcp add twothumbs --url https://twothumbs.co/mcp && codex mcp login twothumbs

macOS/Linux: ~/.cursor/mcp.jsonWindows: %USERPROFILE%\.cursor\mcp.json

{
  "mcpServers": {
    "twothumbs": {
      "url": "https://twothumbs.co/mcp"
    }
  }
}

Select Streamable HTTP in a client that supports remote MCP, then enter:

https://twothumbs.co/mcp

Authentication UI and configuration keys differ by client. Do not configure this as a local stdio command.

Add the remote server, then run /mcp inside Claude Code to authenticate:

claude mcp add --transport http --scope user twothumbs https://twothumbs.co/mcp

Commit this file as .codex/config.toml in the project:

[mcp_servers.twothumbs]
url = "https://twothumbs.co/mcp"
bearer_token_env_var = "TWOTHUMBS_API_KEY"

Store the key as a masked secret named TWOTHUMBS_API_KEY and expose it only to the job: GitHub Actions encrypted secrets, GitLab masked CI/CD variables, CircleCI project contexts, Bitbucket secured repository variables, Azure Pipelines secret variables, or your runner's equivalent secret environment injection. Headless jobs must not depend on IP quota or an OAuth popup.

The endpoint is reachable worldwide over HTTPS only where the client supports remote Streamable HTTP MCP and outbound network policy allows it. Automated or paid use requires a valid API key. This is not a blanket availability guarantee.

Run a public-surface verdict

Call run_verdict with a public URL. Anonymous callers receive the result inline and have no latest-result lookup. API-key callers can use get_last_verdict to retrieve their own latest verdict document; stored evidence artifacts are not exposed by a public download tool. Founder prompt and operator tools are private and are not advertised to public clients.

Use TwoThumbs run_verdict to inspect https://example.com and report only verified findings.

Unconfigured dependencies and downstream checks are NOT VERIFIED, never passed. Authenticated surfaces and downstream proof require private configuration.

Add runs or redeem access

After adding the MCP, choose Redeem a code in a supported OAuth authorization screen, or ask the connected agent to call redeem_code and enter the code you received. The returned tt_live_… key is shown once: save it in a password manager or, for automation, a masked TWOTHUMBS_API_KEY CI secret.

Access codes grant TwoThumbs credits; they are not Stripe promotion or discount codes. You can also email us to request an invoice and credit key. There is no self-serve card checkout in the current invoice launch mode.

Put the verdict in CI

This matches the repository quickstart. --fail-on HIGH exits nonzero for CRITICAL or HIGH findings; the CLI also fails when no downstream check passed.

name: TwoThumbs verdict
on: [push, pull_request]
jobs:
  verify:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm
      - run: npm ci
      - run: npx playwright install chromium --with-deps
      - run: node run.mjs https://example.com --config surfaces/example.json --fail-on HIGH
      - uses: actions/upload-artifact@v4
        if: always()
        with:
          name: twothumbs-verdict
          path: |
            findings.json
            REPORT.md
            artifacts/