Blackwood State

Security headers

blackwood_headers_audit

Read-onlyIdempotent

Use when you need an http security headers audit of a website or URL, with a grade and what to fix. Do not use for vulnerability scans, TLS cipher analysis or pages behind a login. Returns JSON auditing the HTTP security headers of a public URL (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, cookies) with a grade and fixes for 0.007 USDC per call. Typical response time 2500 ms (p95). Category: Infrastructure.

Input Schema

TableJSON Schema

Name	Required	Description	Default
`url`	Yes	Public http(s) URL to audit, e.g. https://example.com
`response_format`	No	concise (the default when omitted) keeps the JSON short: long fields such as base64 images or audio come back as separate image/audio content blocks and other long strings are cut with a marker; detailed returns the full JSON

Output Schema

TableJSON Schema

Name	Required	Description	Default
No arguments

Schema Changelog

Changes observed during successful MCP inspections.

Changed1 schema field changedOct 17, 2026

changedOutput schema / anyOf

Previous value: -[
-  {
-    "additionalProperties": false,
-    "properties": {
-      "checkedAt": {
-        "type": "string"
-      },
-      "checks": {
-        "items": {
-          "additionalProperties": false,
-          "properties": {
-            "advice": {
-              "type": "string"
-            },
-            "header": {
-              "type": "string"
-            },
-            "result": {
-              "enum": [
-                "pass",
-                "warn",
-                "fail",
-                "info"
-              ],
-              "type": "string"
-            },
-            "value": {
-              "type": [
-                "string",
-                "null"
-              ]
-            }
-          },
-          "required": [
-            "header",
-            "result",
-            "value",
-            "advice"
-          ],
-          "type": "object"
-        },
-        "type": "array"
-      },
-      "cookies": {
-        "items": {
-          "additionalProperties": false,
-          "properties": {
-            "httpOnly": {
-              "type": "boolean"
-            },
-            "name": {
-              "type": "string"
-            },
-            "sameSite": {
-              "type": [
-                "string",
-                "null"
-              ]
-            },
-            "secure": {
-              "type": "boolean"
-            }
-          },
-          "required": [
-            "name",
-            "secure",
-            "httpOnly",
-            "sameSite"
-          ],
-          "type": "object"
-        },
-        "type": "array"
-      },
-      "finalUrl": {
-        "type": "string"
-      },
-      "grade": {
-        "type": "string"
-      },
-      "redirects": {
-        "type": "number"
-      },
-      "score": {
-        "type": "number"
-      },
-      "status": {
-        "type": "number"
-      },
-      "url": {
-        "type": "string"
-      }
-    },
-    "required": [
-      "url",
-      "finalUrl",
-      "status",
-      "redirects",
-      "grade",
-      "score",
-      "checks",
-      "cookies",
-      "checkedAt"
-    ],
-    "type": "object"
-  },
-  {
-    "description": "x402 PaymentRequired (returned with isError when payment is needed)",
-    "properties": {
-      "accepts": {
-        "items": {
-          "type": "object"
-        },
-        "type": "array"
-      },
-      "error": {
-        "type": "string"
-      },
-      "extensions": {
-        "type": "object"
-      },
-      "resource": {
-        "type": "object"
-      },
-      "x402Version": {
-        "type": "integer"
-      }
-    },
-    "required": [
-      "x402Version",
-      "accepts"
-    ],
-    "type": "object"
-  }
-]New value: +[
+  {
+    "additionalProperties": false,
+    "properties": {
+      "checkedAt": {
+        "type": "string"
+      },
+      "checks": {
+        "items": {
+          "additionalProperties": false,
+          "properties": {
+            "advice": {
+              "type": "string"
+            },
+            "header": {
+              "type": "string"
+            },
+            "result": {
+              "enum": [
+                "pass",
+                "warn",
+                "fail",
+                "info"
+              ],
+              "type": "string"
+            },
+            "value": {
+              "type": [
+                "string",
+                "null"
+              ]
+            }
+          },
+          "required": [
+            "header",
+            "result",
+            "value",
+            "advice"
+          ],
+          "type": "object"
+        },
+        "type": "array"
+      },
+      "cookies": {
+        "items": {
+          "additionalProperties": false,
+          "properties": {
+            "httpOnly": {
+              "type": "boolean"
+            },
+            "name": {
+              "type": "string"
+            },
+            "sameSite": {
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "secure": {
+              "type": "boolean"
+            }
+          },
+          "required": [
+            "name",
+            "secure",
+            "httpOnly",
+            "sameSite"
+          ],
+          "type": "object"
+        },
+        "type": "array"
+      },
+      "finalUrl": {
+        "type": "string"
+      },
+      "grade": {
+        "type": "string"
+      },
+      "next": {
+        "additionalProperties": false,
+        "description": "Suggested next paid call in the same family (call it in a loop when the task continues)",
+        "properties": {
+          "method": {
+            "enum": [
+              "GET",
+              "POST"
+            ],
+            "type": "string"
+          },
+          "sample": {
+            "description": "Free fixed sample of the whole family",
+            "type": "string"
+          },
+          "service": {
+            "description": "Service id of the suggested next paid call",
+            "type": "string"
+          },
+          "tool": {
+            "description": "MCP tool name of the same call",
+            "type": "string"
+          },
+          "url": {
+            "description": "Paid route of the next call",
+            "type": "string"
+          },
+          "useWhen": {
+            "description": "When the next call is the right one",
+            "type": "string"
+          }
+        },
+        "required": [
+          "service",
+          "tool",
+          "method",
+          "url",
+          "useWhen",
+          "sample"
+        ],
+        "type": "object"
+      },
+      "redirects": {
+        "type": "number"
+      },
+      "score": {
+        "type": "number"
+      },
+      "status": {
+        "type": "number"
+      },
+      "url": {
+        "type": "string"
+      }
+    },
+    "required": [
+      "url",
+      "finalUrl",
+      "status",
+      "redirects",
+      "grade",
+      "score",
+      "checks",
+      "cookies",
+      "checkedAt"
+    ],
+    "type": "object"
+  },
+  {
+    "description": "x402 PaymentRequired (returned with isError when payment is needed)",
+    "properties": {
+      "accepts": {
+        "items": {
+          "type": "object"
+        },
+        "type": "array"
+      },
+      "error": {
+        "type": "string"
+      },
+      "extensions": {
+        "type": "object"
+      },
+      "resource": {
+        "type": "object"
+      },
+      "x402Version": {
+        "type": "integer"
+      }
+    },
+    "required": [
+      "x402Version",
+      "accepts"
+    ],
+    "type": "object"
+  }
+]

AddedOct 17, 2026

TDQS

A4.6/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly/idempotent/openWorld/non-destructive, and the description adds context beyond them: the exact response shape (JSON with grade and fixes), the audited header set, the 0.007 USDC per-call cost, and a 2500 ms p95 latency expectation. Cost and latency disclosure is the kind of operational detail annotations cannot carry.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

It is front-loaded with the usage trigger and exclusions, then pivots to return shape and operational metadata. Slightly dense with trailing pricing/latency/category facts, but every sentence carries information an agent can act on.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, return values need not be spelled out, and the description still covers scope, exclusions, audited headers, cost and latency. Nothing an agent needs to decide or invoke correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, and the url and response_format parameters are fully documented in the schema, including the concise/detailed trade-off. The description adds nothing about parameter semantics beyond that, so the baseline of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a precise verb and resource: an HTTP security headers audit of a website or URL, returning a grade and fixes. It names the exact headers examined (HSTS, CSP, X-Frame-Options, etc.), which no sibling tool overlaps with, so an agent can separate it from domain_intel or webpage_markdown at a glance.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives explicit when-to-use (need a headers audit with grade and fixes) and explicit when-not-to-use (vulnerability scans, TLS cipher analysis, pages behind a login). The login exclusion is a genuinely useful boundary an agent would otherwise get wrong.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Blackwood State tools Inspect

Try in Browser

Context Every Agent Can ShareAgents share what they learn, hand off work, and keep it when you switch models. Start with 5 GB free.fulcradynamics.comAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources

Need Help?