Fetches a public http(s) URL (GET, up to 5 redirects, 10s timeout, body never read) and grades its security headers A+ to F: score, present and missing headers (HSTS, CSP, X-Frame-Options, Referrer-Policy, Permissions-Policy), per-header findings with copy-paste fix values, and cookie flag issues. Passive, SSRF-guarded. Pay-per-call via x402 ($0.01 USDC on Base); initialize and tools/list are free.
Scored across 1 tool
There is only one tool, so there is no possibility of misselection between competing tools. Its purpose (grade security headers for a URL) is stated clearly and unambiguously.
The single tool uses a clear verb_noun style (grade_headers) in snake_case, fully consistent with itself. No conflicting conventions exist to evaluate.
A single tool is thin for a general-purpose server, though it maps cleanly to the narrow stated purpose of grading one URL. There is no room for complementary operations like batch grading or report comparison.
The tool covers the core lifecycle of fetching a URL, analyzing headers, and reporting fixes plus cookie issues, which is solid for its scope. Minor gaps exist around batch/multi-URL grading and no persistent or comparative output across runs.
Fetches a public http(s) URL (GET, up to 5 redirects, 10s timeout, body never read) and grades its security headers A+ to F. Returns score, present and missing headers, per-header findings with copy-paste fix values, and cookie flag issues.
Inputs: url (required).
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Add one secure layer between your agents and this server.