Skip to main content
Glama

HeaderGuard

by dev.workers.mike-tusa.headerguard
OverviewDiscussionsAdmin

Server Details

Scan a website's HTTP security headers (HSTS, CSP, framing, COOP/CORP, cookies). Score + fixes.

If you are the author of this connector, you can claim ownership by verifying the domain or GitHub account it belongs to. Claimed connector authors can inspect health checks, view analytics, and manage their listing.
Status
Healthy
Last Tested
Transport
Streamable HTTP · MCP 2025-11-25
URL

TDQS

Score is being calculated.

Available Tools

1 tool
scan_headersScan a website's HTTP security headers (HSTS, CSP, framing, COOP/CORP/COEP, cookies)
Read-onlyIdempotent
Inspect

Scan the HTTP security headers of a public website. Returns a 0–100 score and A+–F grade (HTTPS 10, HSTS 15, CSP 25, framing 10, X-Content-Type-Options 10, Referrer-Policy 10, Permissions-Policy 5, COOP 5, CORP 5, cookies 5, minus up to 5 for version-leak headers; without HTTPS the score is capped at 39), each header's status and notes, recommended fix headers, and a link to the full report with copy-paste snippets for nginx, Apache, Cloudflare, Netlify, Vercel and Express. Read-only: it sends ordinary GET requests to the site (following up to 10 redirects, each safety-checked) and never reads page bodies. Same engine and scoring as the HeaderGuard JSON API (GET /api/scan).

ParametersJSON Schema
NameRequiredDescriptionDefault
urlYesURL or bare domain to scan, e.g. example.com or https://example.com/login. A bare domain is scanned as https://<domain>/ (plain HTTP if HTTPS does not answer).
include_rawNoAlso return the full /api/scan JSON (redirect chain, all response headers with cookie values redacted, per-platform fix snippets) in structuredContent.raw. Larger output.

Output Schema

ParametersJSON Schema
NameRequiredDescription
rawNoFull /api/scan response (only when include_raw is true)
urlYesNormalized URL that was scanned
planYes
fixesYes
gradeNoOmitted when the grade is withheld
notesNo
scoreNoOmitted when the grade is withheld
apiUrlNo
cachedNo
versionNo
finalUrlYes
findingsYes
reportUrlYes
scannedAtNo
finalStatusNo
reliabilityYes
gradeWithheldYestrue when the site blocked, rate-limited or challenged the scanner
redirectCountNo
gradeWithheldReasonNo

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 1 tool update
    • First observedscan_headers

Related MCP Connectors

Related MCP Servers

  • mcp-headers

    CACTUSCASH
    A
    license
    A
    quality
    C
    maintenance
    Enables Claude to scan a website's HTTP security headers and receive an A–F grade against OWASP best practices, including per-header pass/warn/fail results and copy-paste fixes for missing headers.
    1
    MIT

  • mozilla-observatory

    pipeworx-io
    A
    license
    Not graded
    quality
    C
    maintenance
    Enables scanning any website's HTTP security headers to obtain Mozilla Observatory grades, detailed pass/fail test results with remediation guidance, and grade distribution context.
    75 npm
    MIT

  • web-security-guard

    1nc0gn30
    A
    license
    Not graded
    quality
    B
    maintenance
    Enables AI agents to audit URLs for security headers, generate CSP Level 3 policies, compute SRI hashes, evaluate WCAG 2.2 contrast, and remediate headers.
    MIT
Try in Browser
One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources