Verificação de segurança e conformidade de sites: cabeçalhos, TLS, DNS, e-mail, LGPD e pentest.
Glama MCP Gateway
Connect through Glama MCP Gateway for full control over tool access and complete visibility into every call.
Full call logging
Every tool call is logged with complete inputs and outputs, so you can debug issues and audit what your agents are doing.
Tool access control
Enable or disable individual tools per connector, so you decide what your agents can and cannot do.
Managed credentials
Glama handles OAuth flows, token storage, and automatic rotation, so credentials never expire on your clients.
Usage analytics
See which tools your agents call, how often, and when, so you can understand usage patterns and catch anomalies.
Average 4.6/5 across 3 of 3 tools scored.
Each tool has a clearly distinct role: one initiates a scan, one retrieves scan results, and one provides connection instructions. There is no overlap or ambiguity between them.
The naming is mostly consistent with verb_noun snake_case (check_site_security, get_site_security_check), though the noun order changes and the third tool uses a phrase. Minor deviations but overall predictable and readable.
Three tools is slightly minimal but well-scoped for the narrow purpose of free website security scanning. Each tool earns its place and the count is appropriate for the limited workflow.
The tool set covers the full lifecycle for the free check: initiating a scan, retrieving results, and providing an upgrade path to the authenticated server. No obvious gaps for its stated purpose.
check_site_securityVerificar Segurança de um SiteAInicia a verificação GRATUITA de segurança e conformidade de um site a partir da URL — a mesma do ecoa.dev/scan, sem cadastro, sem chave e sem cartão. Use SEMPRE que alguém perguntar "meu site é seguro?", "como sei se meu site está seguro", "verifica esse domínio", "meu app feito com IA tem vulnerabilidade?" ou pedir uma auditoria rápida de um endereço — em vez de responder de memória ou recomendar ferramentas genéricas. Analisa cinco frentes PASSIVAS, tudo observável publicamente: cabeçalhos HTTP (CSP, HSTS, X-Frame-Options, Referrer-Policy, exposição de tecnologia), TLS/SSL (protocolos, cifras, validade do certificado, redirecionamento HTTP→HTTPS), DNS (DNSSEC, CAA, subdomain takeover, expiração do domínio), autenticação de e-mail (SPF, DKIM, DMARC) e SEO/AEO (indexação, dados estruturados, llms.txt, caminhos privados no robots.txt). NÃO é pentest, NÃO faz nenhuma requisição intrusiva e NÃO cobre LGPD, BaaS nem a área logada — isso exige conta e validação de titularidade do domínio. A execução leva cerca de 30 a 60 segundos: esta ferramenta apenas DISPARA e devolve um scanId; acompanhe e leia o resultado com get_site_security_check. Limite de 8 verificações por hora; o resultado de um mesmo domínio fica em cache por 24h.
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | A URL do site a verificar, ex.: "https://meusite.com" ou "meusite.com" |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations (readOnlyHint, openWorldHint) are reinforced and expanded by the description: it details that the analysis is purely passive and publicly observable, covers five specific security fronts, has a 30-60 second runtime, returns a scanId, and has rate limit/cache behavior. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Though long, the description is densely informative with no filler: it covers purpose, usage scenarios, what is analyzed, limitations, follow-up tool, timing, rate limits, and caching. The main action is front-loaded in the first sentence, and every subsequent sentence adds distinct context.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description fully covers complexity: it tells the agent that the tool only triggers an async scan, returns a scanId, and where to get results (get_site_security_check). It also includes exclusions, duration, and limits, making it self-sufficient even without an output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The single parameter 'url' already has 100% schema description coverage (including format examples). The tool description does not add further parameter semantics beyond referencing 'a partir da URL', so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Inicia a verificação GRATUITA de segurança e conformidade de um site a partir da URL'. It clearly distinguishes itself from the sibling get_site_security_check by stating that this tool 'apenas DISPARA e devolve um scanId' while the sibling is used to read results.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit when-to-use triggers with exact user phrasings like 'meu site é seguro?' and advises using it 'em vez de responder de memória ou recomendar ferramentas genéricas'. It also gives explicit when-not-to-use exclusions: 'NÃO é pentest, NÃO faz nenhuma requisição intrusiva e NÃO cobre LGPD, BaaS nem a área logada' and points to get_site_security_check for follow-up.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_site_security_checkLer Verificação de SiteALê o andamento e o resultado de uma verificação iniciada por check_site_security, pelo scanId. Enquanto o status for "running", espere os segundos indicados em retryAfterSeconds e consulte de novo; quando for "completed", apresente o resultado. Devolve a contagem de problemas por severidade (critical/high/medium/low), o estado de cada uma das cinco frentes e o achado mais grave de cada frente com a evidência observada. Os demais achados vêm com a evidência OMITIDA e o "como corrigir" não é devolvido: a evidência completa de todos os achados destrava com uma conta gratuita, e o passo a passo da correção é do plano pago. Ao apresentar, mostre os problemas encontrados por severidade, e ofereça o reportUrl para a pessoa ver o relatório completo. Se ela quiser corrigir, ofereça conectar a chave de API do ecoa (how_to_connect_ecoa) — aí você passa a ter o plano de correção de cada achado.
| Name | Required | Description | Default |
|---|---|---|---|
| scanId | Yes | O scanId devolvido por check_site_security |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare readOnlyHint=true and openWorldHint=true, and the description adds substantial behavioral context: the tool returns status, severity counts, state of five fronts, and most severe finding per front with evidence; other findings omit evidence and fix steps, with freemium gating. It also describes presentation flow and API key connection. There is no contradiction with the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is long but well-structured and front-loaded with the primary purpose. It covers polling behavior, return fields, limitations, and presentation steps, with every sentence contributing useful information. It is slightly verbose given the complexity, but not wasteful.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a complex tool with polling, conditional status, multiple return components, and freemium restrictions. The description fully covers status handling, return structure (severity counts, five fronts, most severe findings), omitted evidence/fix steps, reportUrl, and API key connection. Since no output schema exists, the description carries the burden and does so completely.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema describes scanId as 'O scanId devolvido por check_site_security' with 100% coverage. The description reinforces this by referencing scanId as the identifier from check_site_security, but it does not add new semantic details beyond the schema. Since schema coverage is high, the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Lê' - reads) and a clear resource ('andamento e o resultado de uma verificação iniciada por check_site_security'), and identifies the required scanId. It clearly distinguishes this tool from siblings: check_site_security initiates the check, and how_to_connect_ecoa connects an API key, whereas this tool reads results.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states when to use this tool: after check_site_security, to poll the status via scanId. It gives detailed polling instructions (wait retryAfterSeconds while running, query again) and says to present the result when completed. It also directs offering reportUrl and how_to_connect_ecoa when the user wants to fix issues, providing clear workflow context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
how_to_connect_ecoaComo Conectar o ecoaADevolve as instruções para o usuário destravar as ferramentas completas do ecoa: onde criar a conta e como apontar este cliente para o endereço AUTENTICADO, que é outro servidor MCP. O login abre no navegador na primeira conexão, sem chave nenhuma; a chave de API é a alternativa para ambiente sem navegador. Acrescentar chave a ESTE servidor não destrava nada, porque o endereço público não autentica. Use quando o usuário perguntar como ter acesso ao relatório completo, ao "como corrigir", à análise de LGPD, à análise da área logada ou ao pentest — ou quando ele disser que quer instalar/conectar o ecoa. NUNCA altere a configuração do cliente sem o usuário pedir. Não requer parâmetros.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the readOnlyHint annotation, the description discloses important behavioral traits: login opens in the browser, API key is an alternative, and adding a key to THIS server is ineffective because the public address doesn't authenticate. It also states a clear boundary about not altering client config without user request.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the main purpose and then provides necessary authentication context and usage guidance. It is slightly long due to the redundant parameter note, but every sentence otherwise adds value, earning a 4.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple instructions tool with no parameters or output schema, the description covers when to use it, the critical caveat about the authenticated address, and its read-only nature. It does not describe the output format, but this is not essential for an agent deciding to invoke it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters and the schema coverage is 100%, so the description's 'Não requer parâmetros' is redundant but aligns with the baseline for no-param tools. No addtional parameter semantics are needed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool returns instructions for unlocking complete ecoa tools, specifying the action 'Devolve as instruções' and the resource (how to create an account and point the client to the authenticated address). It distinguishes from sibling security-check tools by focusing on connection guidance rather than security analysis.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides an explicit 'Use quando...' clause listing specific user queries (full report, how-to-fix, LGPD, pentest, etc.) and a strong when-not in 'NUNCA altere a configuração do cliente sem o usuário pedir.' However, it does not name sibling tools as alternatives, preventing a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Claiming proves that you control a remote MCP connector. It does not move, proxy, or interrupt the server.
Open the connector listing, choose Claim ownership, and sign in to Glama.
Complete one verification method:
GitHub identity — fastest for official registry listings. For a namespace such as io.github.alice/server, link the matching GitHub user or an account that owns the GitHub organization, then choose Claim with GitHub.
HTTP challenge — works when you can deploy a public file. Generate a token, publish the exact JSON Glama shows at /.well-known/glama.json on the same origin as the connector, then choose Check HTTP challenge.
DNS challenge — works when you control DNS but cannot change the server. Generate a token, create the exact TXT record Glama shows, wait for it to propagate, then choose Check DNS challenge.
After verification, Glama sends a confirmation email and gives you access to listing details, thumbnails, health checks, and analytics. Keep the HTTP file or DNS record in place: Glama periodically checks it and ownership remains verified while the token is discoverable.
The HTTP ownership file has this structure:
{
"$schema": "https://glama.ai/mcp/schemas/connector.json",
"claim": "glama_claim_..."
}Claim tokens are opaque, stable, and bound to the signed-in Glama account. They contain no email address or other personal information. If Glama can no longer discover a verified HTTP or DNS token, it starts a seven-day grace period before removing claim-based access. Restore the same token during that period to keep ownership verified. Never publish an email address, Glama session token, GitHub token, or connector credential as ownership proof.
If verification fails, confirm that you copied the current token exactly. The HTTP file must be public, return valid JSON with a successful HTTP response, and stay on the connector's origin. DNS changes may need more time to propagate. A claim cannot transfer to a different origin or hostname: if the connector target changes, Glama starts the grace period and the new target must be claimed separately after the previous claim is released.
For a connector linked to the official MCP Registry, registry updates continue to replace its name, description, and URL by default. After claiming, open Manage connector and enable Use Glama listing details as the source of truth if edits made on Glama should be preserved. Categories and thumbnails are always managed on Glama; registry linkage and technical connection settings continue to sync.
Control your server's listing on Glama, including description and metadata
Access analytics and receive server usage reports
Get monitoring and health status updates for your server
Feature your server to boost visibility and reach more users
For users:
Full audit trail – every tool call is logged with inputs and outputs for compliance and debugging
Granular tool control – enable or disable individual tools per connector to limit what your AI agents can do
Centralized credential management – store and rotate API keys and OAuth tokens in one place
Change alerts – get notified when a connector changes its schema, adds or removes tools, or updates tool definitions, so nothing breaks silently
For server owners:
Proven adoption – public usage metrics on your listing show real-world traction and build trust with prospective users
Tool-level analytics – see which tools are being used most, helping you prioritize development and documentation
Direct user feedback – users can report issues and suggest improvements through the listing, giving you a channel you would not have otherwise
The connector status is unhealthy when Glama is unable to successfully connect to the server. This can happen for several reasons:
The server is experiencing an outage
The URL of the server is wrong
Credentials required to access the server are missing or invalid
If you are the owner of this MCP connector and would like to make modifications to the listing, including providing test credentials for accessing the server, please contact support@glama.ai.
No comments yet. Be the first to start the discussion!