Zovo Website Status Checker

Check security headers

check_security_headers

Read-onlyIdempotent

Checks one public URL from the Zovo edge network and reports the six key security headers with an A-F grade, HTTP status, verdict, response time, TLS, robots.txt and a CSV download. The headers are Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options or frame-ancestors, Referrer-Policy and Permissions-Policy. Use for a current security-header review. It cannot check zovo.one sites, IP literals, private or reserved addresses, or ports other than 80 and 443. Do not use for vulnerability testing, continuous monitoring or more than one site.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "url": "<url>"
    },
    "name": "check_security_headers"
  }
}

Input Schema

Name	Required	Description	Default
`url`	Yes	One website to check the security headers and HTTPS for, e.g. https://example.com.

Output Schema

Name	Required	Description	Default
`tls`	Yes
`url`	Yes
`grade`	Yes
`state`	Yes
`source`	Yes
`status`	Yes
`headers`	Yes
`verdict`	Yes
`total_ms`	Yes
`downloads`	Yes
`final_url`	Yes
`grade_score`	Yes
`status_text`	Yes
`headers_missing`	Yes
`headers_present`	Yes

Schema Changelog

Changes observed during successful MCP inspections.

First observedOct 22, 2026

TDQS

A4.6/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes well beyond the annotations by disclosing the vantage point (Zovo edge network) and concrete hard limits (own-domain, IP literals, reserved ranges, port restrictions). The output enumeration partially duplicates what the output schema already declares, and error/rate-limit behavior for a failed check is not mentioned, so it falls short of a 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with purpose and deliverables, then constraints and exclusions in a logical order. The exhaustive list of the six header names is somewhat bulky but is defensible because it defines the check's scope precisely.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With annotations covering the safety profile and an output schema covering return values, the description fills the remaining gaps: allowed input surface, vantage point, and explicit non-use cases. Nothing an agent needs before calling is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and there is only one parameter, so the baseline is met by the schema alone. The description still adds real semantics the schema does not: the URL must be public, must not be an IP literal, must not be a zovo.one host, must use port 80/443, and only one site per call.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Checks one public URL ... reports the six key security headers') and enumerates exactly what is returned: A-F grade, HTTP status, verdict, response time, TLS, robots.txt, CSV. The 'one public URL' scoping implicitly separates it from the batch sibling check_websites.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides an affirmative trigger ('Use for a current security-header review') plus explicit exclusions: cannot check zovo.one sites, IP literals, private/reserved addresses, or non-80/443 ports, and should not be used for vulnerability testing, continuous monitoring, or more than one site. An agent has everything needed to route correctly.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Zovo Website Status Checker tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources

Need Help?