HubVibe: Pay-per-Call Agent Tools: Web Search, Email Verify, KYC Screening, Stocks, Crypto, News

Security header audit

audit_security

Read-onlyIdempotent

Security headers check for a website: audits HTTPS, HSTS, Content- Security-Policy (CSP), X-Content-Type-Options, X-Frame-Options / clickjacking protection, Referrer-Policy and CORS from the real HTTP response of any live URL. Findings with severity for what is missing. Header posture only, not a penetration test. $0.05 per call. Returns: pass (bool), findings[] with id/severity/detail.

Input Schema

TableJSON Schema

Name	Required	Description	Default
`url`	Yes	Live, fetchable http(s) URL to audit.
`language`	No	Optional BCP-47 language tag (en, ja, ko, pt-BR): the human-readable text of the findings is returned in this language; rule ids, severities, URLs and numbers are untouched. Default: English.

Output Schema

TableJSON Schema

Name	Required	Description	Default
`pass`	Yes
`status`	No
`findings`	No

Schema Changelog

Changes observed during successful MCP inspections.

Changed6 schema fields changedOct 1, 2026

removedOutput schema / properties / findings / description

Removed value: -"One entry per rule that did not pass. Empty when the check is clean."

removedOutput schema / properties / findings / items / properties

Removed value: -{
-  "detail": {
-    "description": "What failed and where.",
-    "type": "string"
-  },
-  "id": {
-    "description": "Stable rule identifier.",
-    "type": "string"
-  },
-  "severity": {
-    "description": "Rule severity.",
-    "type": "string"
-  }
-}

removedOutput schema / properties / findings / items / required
```
Removed value: -[
-  "id"
-]
```
removedOutput schema / properties / findings / items / type
```
Removed value: -"object"
```

removedOutput schema / properties / pass / description

Removed value: -"Whether every rule in this dimension passed."

removedOutput schema / properties / status / description
```
Removed value: -"Present only on a completed audit."
```

Changed1 schema field changedSep 27, 2026

addedInput schema / properties / language

Added value: +{
+  "description": "Optional BCP-47 language tag (en, ja, ko, pt-BR): the human-readable text of the findings is returned in this language; rule ids, severities, URLs and numbers are untouched. Default: English.",
+  "examples": [
+    "ja"
+  ],
+  "maxLength": 35,
+  "pattern": "^[A-Za-z]{2,3}(-[A-Za-z0-9]{2,8})*$",
+  "type": "string"
+}

Changed6 schema fields changedAug 25, 2026

addedInput schema / $schema

Added value: +"https://json-schema.org/draft/2020-12/schema"

changedInput schema / properties / url / description

Previous value: -"Live URL to audit"New value: +"Live, fetchable http(s) URL to audit."

addedInput schema / properties / url / examples
```
Added value: +[
+  "https://example.com"
+]
```
addedInput schema / properties / url / format
```
Added value: +"uri"
```
addedInput schema / title
```
Added value: +"Live URL to audit"
```

changedOutput schema / (root)

Previous value: -nullNew value: +{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "properties": {
+    "findings": {
+      "description": "One entry per rule that did not pass. Empty when the check is clean.",
+      "items": {
+        "properties": {
+          "detail": {
+            "description": "What failed and where.",
+            "type": "string"
+          },
+          "id": {
+            "description": "Stable rule identifier.",
+            "type": "string"
+          },
+          "severity": {
+            "description": "Rule severity.",
+            "type": "string"
+          }
+        },
+        "required": [
+          "id"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "pass": {
+      "description": "Whether every rule in this dimension passed.",
+      "type": "boolean"
+    },
+    "status": {
+      "const": "ok",
+      "description": "Present only on a completed audit.",
+      "type": "string"
+    }
+  },
+  "required": [
+    "pass"
+  ],
+  "type": "object"
+}

First observedAug 11, 2026

TDQS

A4.1/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover safety traits (readOnly, openWorld, idempotent, non-destructive), but the description adds valuable context not in the annotations: $0.05 per call, findings with severity, and that the audit is based on the real HTTP response. It also clarifies the limitation to header posture only, which is important behavioral scoping.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core purpose and stays compact at roughly 60 words. The final returns sentence partly duplicates the output schema, but the cost and limitation details justify most of the text.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With rich annotations, full schema coverage, and an output schema, the description only needs to carry the non-schema context. It does that well by covering cost, scope, findings severity, and the non-penetration-test boundary, though it could more explicitly route against the other audit_* siblings.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the url and language parameters are already fully documented in the schema. The description reinforces "any live URL" but adds no syntax, format, or language-handling detail beyond what the schema provides, making the baseline score appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific action and resource: security headers check for a website, naming HTTPS, HSTS, CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and CORS. It bounds the scope to headers from a real HTTP response of a live URL and explicitly distinguishes itself from a penetration test, so an agent can tell it apart from sibling audit tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives clear context for when to use the tool: checking header posture from a live HTTP response. It also supplies a when-not boundary ("not a penetration test"), but it does not name sibling alternatives such as audit_seo or audit_wcag, so it stops short of explicit routing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All HubVibe: Pay-per-Call Agent Tools: Web Search, Email Verify, KYC Screening, Stocks, Crypto, News tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.