LanguageTool

Search the Azure Marketplace for LanguageTool on Ubuntu 24.04 and choose your VM size.

Attach a network security group (NSG) that allows TCP 22 (SSH) from your management network. Also allow TCP 80 / 443 (the API) from the networks and applications that need to submit text. In production, front port 80 with TLS (see Step 9).

RG="languagetool-prod"; LOCATION="eastus"; VM_NAME="languagetool-01" IMAGE_URN="sac1647283583153:languagetool-ubuntu-24-04:default:latest" SSH_KEY="$(cat ~/.ssh/id_rsa.pub)" az group create --name "$RG" --location "$LOCATION" az network vnet create -g "$RG" --name lt-vnet --address-prefix 10.90.0.0/16 --subnet-name lt-subnet --subnet-prefix 10.90.1.0/24 az network nsg create -g "$RG" --name lt-nsg az network nsg rule create -g "$RG" --nsg-name lt-nsg --name allow-ssh --priority 100 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 22 --access Allow --protocol Tcp az network nsg rule create -g "$RG" --nsg-name lt-nsg --name allow-web --priority 110 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 80 443 --access Allow --protocol Tcp
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:languagetool-ubuntu-24-04:default:latest
az vm create -g "$RG" --name "$VM_NAME" --image "$IMAGE_URN" \
  --size Standard_B2s --storage-sku StandardSSD_LRS \
  --admin-username azureuser --ssh-key-values "$SSH_KEY" \
  --vnet-name lt-vnet --subnet lt-subnet --nsg lt-nsg --public-ip-sku Standard

ssh azureuser@<vm-ip>

The LanguageTool server listens on loopback 127.0.0.1:8081, and nginx fronts the API on port 80. The /healthz endpoint is public. Every other endpoint requires your per-VM password.

sudo systemctl is-active languagetool nginx
sudo ss -tln | grep -E ':80 |:8081' curl -s http://127.0.0.1/healthz

You should see both services active, the two listening sockets, and ok from the health endpoint.

The password was generated on this VM's first boot and stored in a root-only file. Read it and keep it secret, because it authenticates every API request. Then confirm that unauthenticated requests are rejected.

sudo ls -l /root/languagetool-credentials.txt echo "unauthenticated /v2/languages -> HTTP $(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1/v2/languages)"

The info note holds LT_USERNAME (admin) and LT_PASSWORD. It is owned by root:root with mode 0600.

An unauthenticated call to /v2/languages returns 401, because the nginx Basic Auth gate enforces authentication.

Checking text is the core job of LanguageTool. Load the per-VM password into a shell variable, then POST text to the /v2/check endpoint. Pass the text and the language code as form fields. The response is a JSON matches array with one entry per issue.

export
LT_PW=$(sudo grep '^LT_PASSWORD=' /root/languagetool-credentials.txt | cut -d= -f2-)
# A sentence with a deliberate agreement error curl -s -u "admin:$LT_PW" \
  --data-urlencode 'text=This are a test of the LanguageTool server.' \
  --data-urlencode 'language=en-US' \
  http://127.0.0.1/v2/check | python3 -m json.tool

The response lists each issue in matches. The agreement error on "This are" appears with a message, the character offset and length, and a set of suggested replacements.

To check your own text, send it to the same endpoint.

Omit the language field, or set language=auto, to let LanguageTool detect the language automatically. To pick a language yourself, use any supported language code such as de-DE, fr or es.

export
LT_PW=$(sudo grep '^LT_PASSWORD=' /root/languagetool-credentials.txt | cut -d= -f2-)
# Auto detect the language curl -s -u "admin:$LT_PW" \
  --data-urlencode 'text=Ceci est une phrase avec une faute daccord.' \
  --data-urlencode 'language=auto' \
  http://127.0.0.1/v2/check | python3 -c 'import sys,json; d=json.load(sys.stdin); print("detected:", d["language"]["detectedLanguage"]["name"]); print("issues:", len(d["matches"]))'
# List every supported language and its code curl -s -u "admin:$LT_PW" http://127.0.0.1/v2/languages | python3 -c 'import sys,json; d=json.load(sys.stdin); print(len(d), "languages"); [print(" ", x["name"], x["longCode"]) for x in d[:8]]'

When you use auto, /v2/check reports the detected language. /v2/languages returns the full catalogue of supported languages and their codes.

You drive everything through POST /v2/check. The most useful fields are:

• text: the plain text to check (or use data for a JSON annotated document)
• language: a language code (for example en-US, de-DE or fr) or auto to detect it
• motherTongue: your first language, used to catch false friends and interference errors
• enabledRules / disabledRules: comma-separated rule IDs to turn specific checks on or off
• enabledCategories / disabledCategories: the same, at the category level
• level=picky: enables additional, stricter style checks

These introspection endpoints sit behind the Basic Auth gate:

• GET /v2/languages: every supported language and its code
• POST /v2/check: the checking endpoint itself

For example, run a stricter "picky" check:

export
LT_PW=$(sudo grep '^LT_PASSWORD=' /root/languagetool-credentials.txt | cut -d= -f2-)
curl -s -u "admin:$LT_PW" \
  --data-urlencode 'text=The report was authored by the team in a very unique way.' \
  --data-urlencode 'language=en-US' --data-urlencode 'level=picky' \
  http://127.0.0.1/v2/check | python3 -c 'import sys,json; d=json.load(sys.stdin); print("issues:", len(d["matches"])); [print(" -", m["rule"]["id"], ":", m["message"]) for m in d["matches"]]'

nginx fronts the API on port 80 and is ready for TLS. Point a DNS record at the VM. Then obtain a certificate with certbot and let it configure nginx for port 443.

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.example.com

After issuance, restrict the NSG so that only 443 (and 22 from your management network) is reachable. Then submit text over https://your-domain.example.com/v2/check.

In the EC2 console, choose Launch instance from AMI, select the SecureAnyCloud LanguageTool image, and pick an m5.large (or larger) instance type.

Attach a security group that allows TCP 22 (SSH) from your management network and TCP 80 (the API) from the networks and applications that need to submit text. Restrict port 80 to those clients. In production, front it with TLS (see the Enable HTTPS section below).

aws ec2 run-instances \
  --image-id ami-xxxxxxxxxxxxxxxxx \
  --instance-type m5.large \
  --key-name my-key \
  --security-group-ids sg-xxxxxxxx \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=languagetool-01}]'

Once connected over SSH, confirm both services are active.

systemctl is-active languagetool nginx

Both services should report active. The LanguageTool server listens on loopback 127.0.0.1:8081, and nginx is the public listener on port 80.

The first-boot service generated a unique HTTP Basic Auth password for this instance and wrote it to a root-only file. Read it with:

sudo cat /root/languagetool-credentials.txt

The file records the API URL, the user name (admin) and the generated password. The examples below read the password straight from that file, so it never appears on your screen.

Send a sentence with a deliberate agreement error to /v2/check. The JSON response lists each issue with its message and suggested replacements.

PW=$(sudo grep '^LT_PASSWORD=' /root/languagetool-credentials.txt | cut -d= -f2-)
curl -sS -u "admin:$PW" \
  --data-urlencode 'text=This are an test.' \
  --data-urlencode 'language=en-US' \
  http://localhost/v2/check \
  | python3 -c 'import json,sys; d=json.load(sys.stdin); s=d["software"]; print(s["name"], s["version"]); print(len(d["matches"]), "issue(s):"); [print("-", m["message"], "->", ", ".join(r["value"] for r in m["replacements"][:3])) for m in d["matches"]]'

LanguageTool 6.6 flags the singular/plural disagreement (this ... are) and the article before test, each with suggested corrections.

PW=$(sudo grep '^LT_PASSWORD=' /root/languagetool-credentials.txt | cut -d= -f2-)
curl -sS -u "admin:$PW" http://localhost/v2/languages \
  | python3 -c 'import json,sys; d=json.load(sys.stdin); print(len(d), "languages"); [print("-", x["name"], x["longCode"]) for x in d[:12]]'

To let LanguageTool detect the language of the submitted text, omit the language parameter or pass language=auto.

PW=$(sudo grep '^LT_PASSWORD=' /root/languagetool-credentials.txt | cut -d= -f2-)
curl -sS -u "admin:$PW" \
  --data-urlencode 'text=Ceci est un test' \
  --data-urlencode 'language=auto' \
  http://localhost/v2/check \
  | python3 -c 'import json,sys; d=json.load(sys.stdin); print("detected:", d.get("language",{}).get("detectedLanguage",{}).get("name"))'

/healthz is unauthenticated and returns ok. Use it for load balancer target checks and readiness probes.

curl -sS http://localhost/healthz

From a client that can reach port 80, point at the instance's public IP or DNS name and authenticate with the admin user and the generated password. Restrict the security group so that only your clients can reach port 80.

curl -u admin:<password> \
  --data-urlencode 'text=This are an test.' \
  --data-urlencode 'language=en-US' \
  http://<public-ip>/v2/check

You can also point the official LanguageTool browser add-ons and editor plugins at http://<public-ip>/ (or your TLS endpoint) as a custom server.