Guardr
Server Details
Guardr keeps watch on the sites you manage. Check any domain from outside and get an A to F health grade for HTTP headers, TLS, DNS and cookies, with fix steps for configuration findings. Three tools: check_site runs a fresh check of one domain, list_sites lists the sites your account watches and get_site returns one watched site in detail. Read-only: Guardr proposes fixes and never changes a site. Needs a Guardr API key; the first site is free.
- Status
- Healthy
- Uptime
- 31.9% over 41 days
- Last Tested
- Transport
- Streamable HTTP · MCP 2025-11-25
- URL
TDQS
Scored across 3 tools
check_site triggers a fresh check, get_site reads a single watched site's latest data, and list_sites enumerates all watched sites. These are clearly distinct actions on different scopes, so an agent can easily select the right tool.
All tool names follow a consistent snake_case verb_noun pattern: check_site, get_site, list_sites. There is no mixing of conventions or vague verbs.
Three tools is a well-scoped set for reading and triggering site checks. Each tool has a clear, non-redundant purpose, and no tool feels extraneous.
The surface covers listing, reading, and triggering checks for watched sites, but it lacks lifecycle operations such as adding, removing, or updating watched sites. Dedicated retrieval of findings for a site is also missing, which may limit monitoring workflows.
Available Tools
3 toolscheck_siteCheck siteBInspect
Run a fresh check of one site and return its grade, score and findings.
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | The path on that domain. It defaults to /. | |
| domain | Yes | The domain, for example example.com. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, so the description carries the full behavioral burden. It hints that a new check is executed (as opposed to a cached read), but says nothing about cost/quota consumption, expected latency for a scan-like operation, authentication needs, or whether repeated calls are safe.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence that states the action and the return payload with zero filler. Nothing could be removed without losing meaning.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Minimally adequate for a two-parameter tool with no output schema: it names the returned fields (grade, score, findings). However, with no annotations and no output schema, it leaves cost, latency, and auth behavior entirely undisclosed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and both parameters (domain, path with its default) are documented in the schema, so the baseline of 3 applies. The description adds no extra meaning beyond the schema, such as expected domain format or path handling rules.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Run a fresh check'), names the resource (one site), and lists what comes back (grade, score, findings). The word 'fresh' implicitly distinguishes it from the stored-result reading that get_site presumably does, but no sibling is named explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied: 'fresh' suggests using this when current results are needed rather than cached ones. It never states when to prefer get_site or list_sites, nor any prerequisite or exclusion, so the agent must infer the routing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_siteRead siteBInspect
Read one watched site: its latest grade, score, uptime summary and most recent check.
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | The path on that domain. It defaults to /. | |
| domain | Yes | The domain, for example example.com. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. 'Read' implies a non-mutating operation and the description usefully discloses the returned fields, but it says nothing about whether the call triggers a fresh check, permission requirements, or error behavior for an unknown domain.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence with the resource and the returned payload front-loaded; there is no filler and nothing to trim.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no annotations and no output schema, the description should carry more weight; it does describe the return payload, which is valuable, but leaves the relationship to check_site and failure behavior unstated for a tool that an agent could easily confuse with a check action.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, with both 'domain' and 'path' documented in the schema (including the '/' default for path). The description adds no parameter-level meaning beyond that, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Read') and resource ('one watched site') and enumerates the returned data (latest grade, score, uptime summary, most recent check). It distinguishes itself implicitly from list_sites by scoping to a single site, but never names check_site or explains how it differs.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no explicit when-to-use guidance and does not address the alternatives check_site or list_sites. An agent must infer that this is a passive single-site lookup rather than a check-triggering call, which is exactly the distinction that matters here.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_sitesList sitesAInspect
List the sites this account watches, with the latest grade, score and uptime summary for each.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full behavioral burden. It usefully discloses that the response includes the latest grade, score, and uptime summary, but it does not mention read-only safety, permissions, freshness, or pagination behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single front-loaded sentence that states the resource, scope, and returned fields without any filler. Every phrase earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple, parameterless list tool with no output schema and no annotations, the description is nearly complete: it names the resource and summarizes the return content. Additional detail such as pagination or freshness would improve it, but the core contract is clear.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
This is a zero-parameter tool, so the baseline is 4. Schema description coverage is 100% and there are no parameters whose semantics need further explanation in the description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb (List) and resource (sites watched by this account), and it enumerates the returned fields (grade, score, uptime summary). It clearly distinguishes the tool from individual-site siblings like get_site and check_site by being a bulk list, though it does not explicitly name those alternatives.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The listing purpose implies when it should be used, but there is no explicit guidance about when to prefer this over check_site or get_site. No exclusions or prerequisites are stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
3 tool updates
- First observed
check_site - First observed
get_site - First observed
list_sites
Publisher details
- Operator
- Guardr · Publisher source
- Operator website
- https://guardr.io/
- Vendor relationship
- First-party
- Documentation
- https://guardr.io/docs/mcp/
- Trust center
- Not available
- Restrictions
- Requires a Guardr API key. The free plan covers one site; calls share the key's REST API allowance. · Publisher source
Related MCP Connectors
Check a deployed web app for security headers, SEO, accessibility and performance, with a grade.
Inspects live IPv4/IPv6 DNS resolution, TLS certificate issuer/expiry, and HTTP security grade.
Inspects live IPv4/IPv6 DNS resolution, TLS certificate issuer/expiry, and HTTP security grade.
Scan a website's HTTP security headers (HSTS, CSP, framing, COOP/CORP, cookies). Score + fixes.
Related MCP Servers
- AlicenseAqualityBmaintenanceEnables live website health checks including TLS, HTTPS, and security headers, returning an A-F grade with specific fixes.2MIT
- AlicenseNot gradedqualityBmaintenancePerforms domain, email, and web audits in a single tool call, checking DNS, RDAP, TLS, SPF, DMARC, DKIM, MTA-STS, BIMI, security headers, and cookies, and returning reproducible findings with an A–F score. Also captures PNG screenshots of public URLs, working read-only against public records with no caching between calls.MIT
- AlicenseNot gradedqualityAmaintenanceEnables grading a website's security headers with per-gap fixes and a README badge, and analyzing logs, code, configs or suspicious messages to determine what happened, how severe it is, and what to fix first. Requests are masked for sensitive data and automatically retried across multiple AI providers when one refuses, subject to a defensive-use-only policy.1MIT
- AlicenseAqualityCmaintenanceEnables AI agents and developers to audit any URL or domain for seven critical OWASP HTTP security headers, returning an A+ to F grade plus actionable Nginx, Apache, Caddy, and Cloudflare remediation snippets. It also probes /.well-known/security.txt and /security.txt to surface responsible vulnerability disclosure contacts, bug bounty scopes, and PGP keys.2MIT
Glama MCP Gateway
Add one secure layer between your agents and this server.