01
Create an account
Sign up with email or Google, confirm your address, and open the dashboard.
Threatless
Antivirus for developers
Scan files and URLs for malware with one REST request. Built for upload APIs, CI pipelines, and anyone who is tired of bolting a desktop antivirus onto a server.
Your app Scan API
POST /api/v1/scans
Round trip
28ms
{
"infected": false,
"virusName": null
}
One endpoint for malware verdicts
Stop guessing whether an upload is safe. Send the bytes — or a public URL — to POST /api/v1/scans with X-API-KEY. Threatless streams them through ClamAV in memory and returns JSON you can branch on: infected, virusName, size, duration.
A result you can automate on
Every successful scan includes filename, extension, sizeInBytes, scanDurationMillis, infected, and virusName. Hourly quota is visible as X-RateLimit-Limit, Remaining, and Reset — including Retry-After when you hit the ceiling.
installer.exe
45ms Infected
Trojan.Generic.12345
document.pdf
22ms Clean
No threats detected
malware.bat
38ms Infected
Win32.Trojan.Injector
Fast enough for the request path
Typical scans finish in tens of milliseconds once the payload reaches the API. Wire it into an upload handler, a GitHub Action, or a support inbox without standing up clamd yourself.
Your app Scan API
POST /api/v1/scans
Round trip
28ms
{
"infected": false,
"virusName": null
}
Scan in memory, keep metadata
File bytes are not written for the scan. URL fetches reject private, loopback, and cloud-metadata targets. What remains on your account is the verdict history the dashboard needs — not a copy of the file.
Keys, quota, and billing in one place
Create API keys, watch clean versus infected volume, revoke sessions, and upgrade through Stripe. The dashboard scanner uses your session when you do not want to script.
How it works
Four steps from signup to verdict
The hosted API and the dashboard scanner share the same ClamAV engine, size cap, and hourly quota.
02
Mint an API key
Generate a 32-character key and send it as X-API-KEY on every public scan.
03
POST a file or URL
Upload bytes or point at a public HTTP(S) link. The cap is 10 MB either way.
04
Read the JSON verdict
infected, virusName, size, and duration come back with hourly quota headers.
Use cases
Where Threatless fits
Drop scanning in front of anything that accepts untrusted files. Keep the rest of the stack unchanged.
Upload APIs
Scan user-generated files before they hit object storage or a processing queue.
CI pipelines
Fail a GitHub Action when a build artifact matches a ClamAV signature.
Public downloads
Ask Threatless to fetch a public URL, with private and metadata hosts blocked.
Support inboxes
Check attachments from a ticket form without standing up your own clamd.
Trust
Built to scan, not to keep
Threatless is a ClamAV-backed scanning API with quotas you can code against and a privacy story you can explain to security review.
Bytes never stored
Scans use ClamAV INSTREAM in memory. Only metadata lands in your history.
ClamAV signatures
The same engine teams already trust, with daily freshclam updates.
Honest quotas
Hourly limits, X-RateLimit headers, and a 10 MB cap you can code against.
Self-hostable
Run the Nuxt app and the API+ClamAV image on your own Docker network.
Pricing that matches hourly load
Quota is per clock hour, not per month. Start free at 5 scans/hour, then scale without changing the integration.
Free
Ship a first integration without a credit card.
5/hour
$0/month
- 5 scans per clock hour
- File and URL scanning
- Dashboard scanner
- API keys and history
- Community email support
Starter
For small upload APIs and quiet CI jobs.
50/hour
$15/month
- 50 scans per clock hour
- Same 10 MB payload cap
- Rate-limit headers
- Stripe self-serve billing
- Email support
Pro
Steady product traffic without babysitting 429s.
100/hour
$25/month
- 100 scans per clock hour
- File and URL scanning
- Dashboard analytics
- Session revoke
- Email support
Business
High-volume uploads and shared CI accounts.
500/hour
$99/month
- 500 scans per clock hour
- Priority when quota is planned
- Same privacy guarantees
- Stripe portal
- Email support
Need 1,000 to 10,000 scans/hour? Compare every plan
FAQ
Questions teams ask first
Short answers. The docs cover the contract, errors, and EICAR testing in full.
Files you upload and public HTTP(S) URLs, up to 10 MB. The engine is ClamAV. You get JSON back: infected, virus name, size, and duration. Private, loopback, and cloud-metadata URLs are rejected.
No. File bytes are streamed to clamd and discarded. Threatless stores scan metadata (filename, verdict, duration) so the dashboard can show history. See the Privacy Policy for the full list.
Typical scans complete in tens of milliseconds once the bytes reach the API. Duration is returned as scanDurationMillis so you can chart it. Network time and file size dominate for larger payloads.
Use the official EICAR test file from eicar.org. It is a harmless ASCII sample that antivirus engines, including ClamAV, report as a test signature. Threatless docs explain how to obtain it safely — we never embed the payload.
Five scans per clock hour, the same API and dashboard as paid plans, and no credit card. Upgrade when you consistently hit the hourly ceiling. Keys on one account share the quota.
Yes. Docker Compose runs the web app and a Spring Boot API with ClamAV bundled. You provide PostgreSQL and the threatless Docker network. Paid Stripe billing is optional on self-hosted instances.
Keep every upload threatless
One endpoint, a JSON verdict, and an hourly quota you can automate on. That is the developer experience Threatless is built to deliver.