F
licenseNot graded
qualityD
maintenanceAnalyze and score HTTP security headers (CSP, HSTS, CORS, cookies) with actionable fix recommendations for web applications.
-
HeaderGuard
Server Details
Scan a website's HTTP security headers (HSTS, CSP, framing, COOP/CORP, cookies). Score + fixes.
Ownership verified
- Status
- Healthy
- Uptime
- 100.0% over 23 days
- Last Tested
- Transport
- Streamable HTTP · MCP 2025-11-25
- URL
TDQS
A4.4/5.0
Scored across 1 tool
Disambiguation5/5
Only one tool exists, so there is no possibility of misselection or overlapping purpose. The tool's scope (scanning HTTP security headers) is stated unambiguously.
Naming Consistency5/5
The single name scan_headers follows a clean verb_noun snake_case convention. There are no competing names or mixed conventions to create inconsistency.
Tool Count3/5
The server has a narrow, single-purpose domain (header security scanning), so one tool is defensible, but a surface of exactly one tool is thin and offers no room for batch scans or related workflows.
Completeness4/5
The tool covers scoring, per-header status, fix recommendations, and multi-platform snippets, which is strong lifecycle coverage for the scan itself. Minor gaps remain, such as scanning multiple URLs or comparing historical scans.
Available Tools
1 toolscan_headersScan a website's HTTP security headers (HSTS, CSP, framing, COOP/CORP/COEP, cookies)ARead-onlyIdempotentInspect
Scan the HTTP security headers of a public website. Returns a 0–100 score and A+–F grade (HTTPS 10, HSTS 15, CSP 25, framing 10, X-Content-Type-Options 10, Referrer-Policy 10, Permissions-Policy 5, COOP 5, CORP 5, cookies 5, minus up to 5 for version-leak headers; without HTTPS the score is capped at 39), each header's status and notes, recommended fix headers, and a link to the full report with copy-paste snippets for nginx, Apache, Cloudflare, Netlify, Vercel and Express. Read-only: it sends ordinary GET requests to the site (following up to 10 redirects, each safety-checked) and never reads page bodies. Same engine and scoring as the HeaderGuard JSON API (GET /api/scan).
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | URL or bare domain to scan, e.g. example.com or https://example.com/login. A bare domain is scanned as https://<domain>/ (plain HTTP if HTTPS does not answer). | |
| include_raw | No | Also return the full /api/scan JSON (redirect chain, all response headers with cookie values redacted, per-platform fix snippets) in structuredContent.raw. Larger output. |
Output Schema
| Name | Required | Description |
|---|---|---|
| raw | No | Full /api/scan response (only when include_raw is true) |
| url | Yes | Normalized URL that was scanned |
| plan | Yes | |
| fixes | Yes | |
| grade | No | Omitted when the grade is withheld |
| notes | No | |
| score | No | Omitted when the grade is withheld |
| apiUrl | No | |
| cached | No | |
| version | No | |
| finalUrl | Yes | |
| findings | Yes | |
| reportUrl | Yes | |
| scannedAt | No | |
| finalStatus | No | |
| reliability | Yes | |
| gradeWithheld | Yes | true when the site blocked, rate-limited or challenged the scanner |
| redirectCount | No | |
| gradeWithheldReason | No |
TDQS
A4.4/5.0
Behavior5/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already establish read-only, idempotent, open-world, and non-destructive behavior. The description adds substantial extra context: redirect handling up to 10 hops, never reading page bodies, scoring formula details, and equivalence to the HeaderGuard JSON API.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness4/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded and information-dense, with the purpose stated first and supporting details following. However, the parenthetical scoring breakdown is lengthy, and some return-value detail overlaps with the output schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness5/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers purpose, return summary, scoring behavior, request safety, and API equivalence. With rich annotations and an output schema already present, an agent has everything needed to invoke and interpret the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters3/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the url and include_raw parameters are already well documented in the schema. The description does not add further parameter-specific meaning such as URL edge cases or include_raw tradeoffs, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: scanning HTTP security headers of a public website. It also names the exact header families covered, making the tool's scope immediately clear even without sibling tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines4/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description makes clear this is for public websites and explains the scan is read-only using ordinary GET requests. It does not explicitly state when not to use it, but with no sibling tools and a clear public-site scope, the context is sufficient.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
1 tool update
- First observed
scan_headers
Related MCP Connectors
Scan a website for vulnerabilities: OWASP Top 10, CVEs, SSL, headers - with plain-English fixes
Checks HTTP response headers you paste: 7 security checks with copy-paste fixes. No fetching.
Check a deployed web app for security headers, SEO, accessibility and performance, with a grade.
MDN HTTP Observatory — grade any website's HTTP security headers and get the specific fixes, from…
Related MCP Servers
- AlicenseNot gradedqualityBmaintenanceEnables AI assistants to scan any website's HTTP security headers — HSTS, CSP, framing, COOP/CORP, and cookies — returning a score along with fix snippets.MIT
- AlicenseAqualityCmaintenanceEnables AI agents and developers to audit any URL or domain for seven critical OWASP HTTP security headers, returning an A+ to F grade plus actionable Nginx, Apache, Caddy, and Cloudflare remediation snippets. It also probes /.well-known/security.txt and /security.txt to surface responsible vulnerability disclosure contacts, bug bounty scopes, and PGP keys.2MIT
- AlicenseAqualityCmaintenanceEnables Claude to scan a website's HTTP security headers and receive an A–F grade against OWASP best practices, including per-header pass/warn/fail results and copy-paste fixes for missing headers.1MIT
Try in Browser
One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd
Glama MCP Gateway
Add one secure layer between your agents and this server.