Skip to main content
Glama

HTTP probe + security headers

http_probe
Read-onlyIdempotent

Is a site up and how is it served: status, full redirect chain, timings (DNS/TLS/first byte/total), server, CDN, caching, compression, and a graded security-header check (HSTS, CSP, frame, sniffing…). One real GET from our server. The security grade counts HSTS, Content-Security-Policy, X-Frame-Options/frame-ancestors, X-Content-Type-Options, Referrer-Policy and Permissions-Policy. Price: $0.001 per call (10 free/day).

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
urlYes

Schema Changelog

Changes observed during successful MCP inspections.

  1. Added

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, openWorldHint, idempotentHint, and destructiveHint false, covering safety. The description adds valuable behavioral context: it states 'One real GET from our server,' which implies a network request with potential side effects on the target, and discloses pricing and free tier. This goes beyond annotations and helps the agent anticipate costs and external interaction.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is reasonably concise given the breadth of information it conveys. It front-loads the core purpose with a question, then lists key outputs in a structured list, and includes pricing at the end. Every sentence contributes to the agent's understanding; no filler. It's slightly long but each detail is relevant.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the main outputs (status, redirect chain, timings, server info, security grade) and includes cost details. With no output schema, it adequately describes the return content. It doesn't mention error handling (e.g., if the site is down or unreachable), which is a minor gap, but the overall coverage is strong for a single-parameter probe tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With schema coverage at 0%, the description must compensate for the single 'url' parameter. The description implies the input is a site URL ('Is a site up'), but it never explicitly mentions the parameter name or any constraints (e.g., must be http/https). The schema type is string, but no additional semantics are provided, so the description adds minimal value beyond the obvious.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: checking if a site is up and how it's served, listing specific outputs (status, redirect chain, timings, server, CDN, caching, compression, security header grade). It distinguishes itself from siblings like web_read and web_meta by focusing on HTTP details and security headers, making it identifiable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage by describing what it does, but it does not explicitly compare to alternatives or state when not to use it. For example, it doesn't say 'use this instead of web_read if you need timing and security checks.' The context (making a real GET, pricing) gives some guidance, but the lack of explicit exclusions or alternative references keeps it at implied usage.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources