security_headers_check
Read-only
Analyse the HTTP security headers of a public URL OR of raw response headers you paste in. Grades each header (A–F) for: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, X-XSS-Protection, Cross-Origin-Opener-Policy, Cross-Origin-Resource-Policy, and Cross-Origin-Embedder-Policy. Returns an overall score (0–100), per-header grades, missing headers, and fix snippets for Express, Nginx, and Apache. For localhost/private targets the remote server cannot reach, pass the headers parameter instead of url.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| url | No | Optional. Full public URL to check (e.g. https://example.com). Omit it entirely when using `headers`. The server cannot reach localhost/private IPs. | |
| headers | No | Optional, and sufficient on its own (no url needed). The response headers to grade, either as an object {"strict-transport-security": "max-age=...", ...} or as the raw header block pasted as a string (e.g. `curl -sI` output). Use this to audit a local server the remote MCP cannot reach. |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| fix | No | ||
| key | No | ||
| url | No | ||
| weak | No | ||
| grade | No | ||
| score | No | ||
| value | No | ||
| header | No | ||
| source | No | ||
| weight | No | ||
| details | No | ||
| missing | No | ||
| weak_count | No | ||
| missing_count | No | ||
| overall_grade | No | ||
| headers_checked | No |