Skip to main content
Glama

Go-Live Check

Server Details

Checks HTTP response headers you paste: 7 security checks with copy-paste fixes. No fetching.

If you are the author of this connector, you can claim ownership by verifying the domain or GitHub account it belongs to. Claimed connector authors can inspect health checks, view analytics, and manage their listing.
Status
Healthy
Last Tested
Transport
Streamable HTTP · MCP 2025-06-18
URL

TDQS

A3.8/5.0

Scored across 4 tools

Disambiguation5/5

Each tool targets a distinct action in the workflow: analyze (run the check), explain (understand a finding), get_fix (remediate), and report_feedback (report outcomes). The boundaries are clear and an agent can easily select the right one.

Naming Consistency4/5

All four names follow a consistent snake_case verb_noun pattern (analyze_headers, explain_finding, get_fix, report_feedback). The verb styles vary slightly (analyze/explain/report vs the generic get), but the convention is uniformly applied.

Tool Count4/5

Four tools is on the thin side but well-matched to a focused header-checking domain. Each tool earns its place in the analyze-explain-fix-feedback loop with no redundancy.

Completeness4/5

The surface covers a full lifecycle: analyze headers, explain a finding, fetch platform-specific fixes, and report feedback. Minor gaps exist (e.g. no way to list or batch all findings/fixes at once), but core workflows are covered.

Available Tools

4 tools
analyze_headersA
Read-onlyIdempotent
Inspect

Check raw HTTP response headers from a deployment you already operate. Returns the same object as POST /v1/analyze. Unknown fields are ignored. A url field is not fetched. Nothing is stored. Nothing is for sale.

ParametersJSON Schema
NameRequiredDescriptionDefault
platformNoPlatform whose config the caller can edit. A fix snippet is attached only for caddy, nginx, vercel, netlify, or nextjs. Any other declared platform, or an omitted platform, returns fix null. This server does not guess the platform from the Server header.
config_textNoOptional config text. Not copied into the response. When platform is caddy and this is non-empty, GLC-HSTS-MISSING includes config_header present or absent for one Caddy Strict-Transport-Security form with max-age greater than 0, GLC-CSP-MISSING includes config_header present or absent for one Caddy Content-Security-Policy form with a non-empty quoted value, GLC-NOSNIFF-MISSING includes config_header present or absent for one Caddy X-Content-Type-Options form set to nosniff, GLC-FRAME-MISSING includes config_header present or absent for one Caddy X-Frame-Options form set to DENY or SAMEORIGIN, GLC-REFERRER-MISSING includes config_header present or absent for one Caddy Referrer-Policy form with a non-empty value, and GLC-SERVER-VERSION-LEAK includes config_header present or absent only when that text deletes both Server and X-Powered-By. One deletion is absent. GLC-CORS-WILDCARD-CREDENTIALS includes config_header present or absent for one Caddy > replace of Access-Control-Allow-Origin whose replacement is non-empty and is not *. A line that sets that header without >, and a deletion, are absent. A Content-Security-Policy frame-ancestors line does not count as X-Frame-Options. When platform is nginx and this is non-empty, GLC-HSTS-MISSING includes config_header present or absent for one nginx add_header Strict-Transport-Security line with max-age greater than 0, GLC-CSP-MISSING includes config_header present or absent for one nginx add_header Content-Security-Policy line whose quoted value is non-empty after trim, and GLC-NOSNIFF-MISSING includes config_header present or absent for one nginx add_header X-Content-Type-Options line whose quoted value is nosniff. Any other value is absent. GLC-FRAME-MISSING includes config_header present or absent for one nginx add_header X-Frame-Options line whose quoted value is DENY or SAMEORIGIN. Any other value is absent. Content-Security-Policy-Report-Only does not count. A Content-Security-Policy frame-ancestors line does not count as X-Frame-Options. An empty quoted value, or a quoted value that is only spaces, is absent. A value that contains {, }, or $ is absent. GLC-REFERRER-MISSING includes config_header present or absent for one nginx add_header Referrer-Policy line whose quoted value is non-empty after trim. After trim, the accepted lines are add_header Referrer-Policy "<value>" always; and add_header Referrer-Policy "<value>";. The semicolon is required. An empty quoted value, or a quoted value that is only spaces, is absent. A value that contains {, }, or $ is absent. When platform is nginx, the version-leak field is present only for both lines server_tokens off; and proxy_hide_header X-Powered-By;. One of those lines is absent. The CORS field is present for one add_header Access-Control-Allow-Origin line whose quoted value is non-empty after trim and is not *. When platform is vercel, JSON headers entries are scanned for HSTS, CSP, nosniff, frame, referrer, and Access-Control-Allow-Origin using those same value rules, and the version-leak field is absent because vercel.json cannot delete Server or X-Powered-By. When platform is netlify, an indented Header: value line is scanned the same way, and the version-leak field is absent. When platform is nextjs, a headers() key and value pair is scanned the same way, and the version-leak field is present only when poweredByHeader is false. A value that contains {, }, or $ is absent. The Caddy scans still run only when platform is caddy. Other config text is not checked. Do not include secret values.
headers_rawYesRaw HTTP response headers from a deployment this agent already operates, including an optional status line, as curl -sI prints them. This server does not request a URL.
paths_testedNoOptional paths. Accepted and not checked. This server does not request them.

Output Schema

ParametersJSON Schema
NameRequiredDescription
notesYes
schemaYes
checkedYes
findingsYes
platformYes
config_textYes
paths_tested_countYes
parsed_header_countYes

TDQS

A3.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent, non-destructive and closed-world, so the safety profile is covered. The description adds real context beyond that: unknown fields are ignored, no URL is fetched, nothing is stored, and the return shape matches POST /v1/analyze. It does not discuss auth or rate limits, so not a 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Five short, front-loaded sentences with no bloat; the key scope constraint (you already operate the deployment) leads. 'Nothing is for sale' is an unusual note but it does carry meaning about no upsell/monetization.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With a rich output schema and fully documented parameters, the description only needs to frame purpose and boundaries, which it does. The reference to 'the same object as POST /v1/analyze' presumes knowledge of a separate endpoint, a minor gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and the per-parameter descriptions are extremely detailed, so baseline is 3. The description only adds marginal clarification ('A url field is not fetched', 'Unknown fields are ignored') that lightly reinforces the headers_raw semantics.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: checks raw HTTP response headers from a deployment the caller operates. That is clearly distinct from the sibling tools (explain_finding, get_fix, report_feedback), though the description never names or contrasts them explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'from a deployment you already operate' implies when the tool applies (you have the headers, you are not scanning third parties), but there is no explicit when-to-use/when-not guidance and no routing to alternatives among the siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

explain_findingA
Read-onlyIdempotent
Inspect

Explain one finding id from the seven. Returns id, severity, why, and answer_page. answer_page is the CSP and clickjacking page for GLC-CSP-MISSING and GLC-FRAME-MISSING, and null for the other five. Unknown fields are ignored. A url field is not fetched. Nothing is stored. Nothing is for sale.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYesOne finding id from the seven. Unknown fields are ignored. A url field is not fetched.

Output Schema

ParametersJSON Schema
NameRequiredDescription
idYes
whyYes
severityYes
answer_pageYeshttps://dontdeployonfriday.com/csp-and-clickjacking.html for GLC-CSP-MISSING and GLC-FRAME-MISSING. Null for the other five. This server does not fetch it.

TDQS

A3.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover readOnly, idempotent, non-destructive and closed-world behavior, so the bar is lower. The description still adds real context: a url field is not fetched (relevant for an agent worried about SSRF side effects), nothing is stored, and the conditional null vs. page behavior of answer_page. The 'Nothing is for sale' line is filler rather than disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The key facts (return shape, conditional answer_page) are front-loaded and the fragment style is compact. However, 'Nothing is stored. Nothing is for sale.' is an unexplained aside that does not earn its place, and the sentences are choppy enough to read as accumulated boilerplate.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be re-explained, yet the description usefully clarifies the one non-obvious output case (answer_page is populated only for GLC-CSP-MISSING and GLC-FRAME-MISSING). For a single-enum-parameter lookup tool this is essentially complete; only the sibling routing is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There is a single parameter with 100% schema description coverage and an explicit enum, so the schema carries the semantics. The description only restates the id set and notes unknown fields are ignored, which the schema also states. Baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (explain) and resource (one finding id from a fixed set of seven) and enumerates the return shape (id, severity, why, answer_page). This is clearly distinguishable from get_fix in intent, though the description never names or contrasts the sibling tools explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied: 'one finding id from the seven' tells the agent this operates on ids surfaced by analyze_headers, and the enum constrains it to that set. But there is no explicit when-to-use versus get_fix or report_feedback, and no statement of prerequisites or when not to call it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_fixA
Read-onlyIdempotent
Inspect

Return the registry snippet for one finding id and one platform. The platforms are caddy, nginx, vercel, netlify, nextjs. The result is id and fix. fix has platform, snippet, source_url, and last_verified, and note when the registry file has one. An omitted or unknown platform returns fix null. Unknown fields are ignored. A url field is not fetched. source_url is not fetched. Nothing is stored. Nothing is for sale.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYesOne finding id from the seven. Unknown fields are ignored. A url field is not fetched.
platformNoPlatform whose config the caller can edit. caddy, nginx, vercel, netlify, nextjs returns that registry snippet. Any other value, or an omitted platform, returns fix null. This server does not guess the platform from the Server header. source_url is a citation and is not fetched.

Output Schema

ParametersJSON Schema
NameRequiredDescription
idYes
fixYes

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent, non-destructive, and closed-world, so the safety profile is covered. The description adds genuinely useful behavior beyond that: omitted/unknown platform yields fix null, unknown fields are ignored, and the url/source_url fields are never fetched (no network side effect).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The opening sentence is well front-loaded and the platform list is useful. But "A url field is not fetched. source_url is not fetched." duplicates both itself and the schema, and the trailing "Nothing is stored. Nothing is for sale." is noise that does not earn its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, yet the description still sketches the return shape (id and fix, with platform/snippet/source_url/last_verified/note) and covers the error path. Given the simple two-parameter surface, nothing an agent needs to invoke it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and both parameters are fully documented there, so the baseline is 3. The description largely restates the schema (platform list, null fallback, url not fetched) rather than adding new syntax or format meaning.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ("Return the registry snippet for one finding id and one platform") and enumerates the exact platform values that produce a result. This is clearly distinguishable from siblings like explain_finding, which would explain a finding rather than hand back a registry snippet.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description constrains the input ("the platform whose config the caller can edit") and defines the null-result case, which implies usage. However, it never states when to call get_fix versus explain_finding or analyze_headers, so the agent gets no explicit routing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

report_feedbackB
Read-onlyIdempotent
Inspect

Report one finding id and one outcome. The outcomes are false_positive, fix_worked, fix_failed. The result is id, outcome, and stored false. Nothing is written: no file, no counter, and no log line. A note, a url, and headers are ignored. A url field is not fetched. This server does not guess the platform from the Server header. Nothing is for sale.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYesOne finding id from the seven. A note, a url, and headers are ignored. A url field is not fetched.
outcomeYesExactly one of false_positive, fix_worked, fix_failed. Any other value is unknown_outcome. Nothing is written.

Output Schema

ParametersJSON Schema
NameRequiredDescription
idYes
storedYes
outcomeYes

TDQS

B3.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes well beyond the annotations by declaring that nothing is persisted ('no file, no counter, and no log line'), that extra fields (note, url, headers) are ignored and urls are not fetched, and that the server does not infer platform from the Server header. This meaningfully clarifies the no-side-effect profile, though some sentences ('Nothing is for sale') add noise rather than behavioral clarity.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The core constraint is front-loaded, but the prose is choppy and uneven: 'The result is id, outcome, and stored false' is awkward, and sentences like 'This server does not guess the platform from the Server header' and 'Nothing is for sale' do not clearly earn their place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present and full annotation coverage, the description supplies enough behavioral context (no writes, extra fields ignored, url not fetched) for an agent to call it confidently. Only the missing usage routing keeps it from being fully complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with both parameters documented via enums, so the schema carries the semantics. The description restates the outcome values and notes that unused fields are ignored, but adds no syntax or format detail beyond the schema, matching the baseline 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resources: 'Report one finding id and one outcome,' and names the three valid outcomes. The function is clearly distinct from analyze_headers, explain_finding and get_fix, though the description never explicitly differentiates itself from them.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no when-to-use guidance, no prerequisites, and no mention of the sibling tools or when one should prefer this over them. The agent must infer context from the tool name alone.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 4 tool updates
    • First observedanalyze_headers
    • First observedexplain_finding
    • First observedget_fix
    • First observedreport_feedback

Related MCP Connectors

Related MCP Servers

  • A
    license
    A
    quality
    C
    maintenance
    Enables AI agents and developers to audit any URL or domain for seven critical OWASP HTTP security headers, returning an A+ to F grade plus actionable Nginx, Apache, Caddy, and Cloudflare remediation snippets. It also probes /.well-known/security.txt and /security.txt to surface responsible vulnerability disclosure contacts, bug bounty scopes, and PGP keys.
    2
    MIT
  • A
    license
    Not graded
    quality
    C
    maintenance
    Enables AI assistants to scan any website's HTTP security headers — HSTS, CSP, framing, COOP/CORP, and cookies — returning a score along with fix snippets.
    MIT
  • A
    license
    Not graded
    quality
    B
    maintenance
    Enables AI agents to audit URLs for security headers, generate CSP Level 3 policies, compute SRI hashes, evaluate WCAG 2.2 contrast, and remediate headers.
    MIT
Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources