Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@web-doctor check the health of example.com"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Give it a domain, get an A–F health grade for its TLS, HTTPS and security headers — checked live.
web-doctor opens a real TLS connection to the target and fetches its HTTP headers, then grades:
🔐 TLS certificate — validity & trusted issuer, hostname (SAN) match, days until expiry, self-signed / expired detection
🧩 TLS version — flags obsolete TLS 1.0/1.1; notes TLS 1.2 vs the stronger TLS 1.3
↪️ HTTPS upgrade — does plain http:// 301-redirect to https://?
🛡️ Security headers — Strict-Transport-Security (HSTS), Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy — present and well-formed
⚡ Availability — HTTP status & response latency
…and returns a single A–F grade with a concrete fix for every issue.
It is read-only: it never logs in or changes anything on the target.
An LLM agent can't open a socket or finish a TLS handshake on its own. web-doctor does the live network work server-side and hands back a clean, graded verdict — so an agent (or a CI step) can audit a deployment in one call.
Related MCP server: Webby MCP Server
{
"mcpServers": {
"web-doctor": { "command": "npx", "args": ["-y", "web-doctor-mcp"] }
}
}Tools:
check_website_health — { "target": "example.com" }
check_many — { "targets": ["example.com", "github.com"] }
Or connect over HTTP at POST https://web-doctor.vercel.app/mcp.
GET https://web-doctor.vercel.app/check?target=example.com
GET https://web-doctor.vercel.app/check?target=https://github.com
GET https://web-doctor.vercel.app/check_many?targets=example.com,github.com,vercel.comRate-limited to 30 requests/hour/IP.
The /pro/* routes are gated by x402. Your agent pays $0.02 USDC per call automatically and gets the result. Settles on-chain (Base) to the operator wallet.
GET https://web-doctor.vercel.app/pro/check?target=<domain> # 402 → pay → result
GET https://web-doctor.vercel.app/pro/check_many?targets=... # up to 50 targets🟢 A — github.com (health score 96/100)
A — github.com is healthy: valid certificate, HTTPS enforced and the key security headers are in place.
TLS / certificate:
• Protocol: TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 handshake=84ms
• Certificate: valid & trusted issuer=CN=Sectigo ... expires in 220d
HTTP:
• Status 200 latency=140ms server=github.com
• HTTP→HTTPS redirect: yes
Security headers:
✅ Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
✅ Content-Security-Policy: default-src 'none'; ...
✅ X-Frame-Options: deny
✅ X-Content-Type-Options: nosniff
✅ Referrer-Policy: ...
✅ Permissions-Policy: ...npm install
npm run build
npm run test:engine # live smoke test
npm run dev:http # local server on :8080 (payments default ON; set X402_ENABLED=false to disable)
npm run dev:mcp # stdio MCP serverVar | Purpose |
| receiving wallet (default set) |
|
|
|
|
| mainnet facilitator that settles on the chosen network (required to actually collect on mainnet) |
|
|
MIT
Run the live web health & security check on several domains/URLs at once and return one A–F grade per site. Useful to audit a fleet of sites or compare deployments.
| Name | Required | Description | Default |
|---|---|---|---|
| targets | Yes | List of domains or URLs to check. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full responsibility for behavioral disclosure. It mentions it is a 'live' check returning 'A–F grade', but does not address potential side effects, rate limits, or authentication requirements.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise with two sentences, no filler. It front-loads the action and purpose effectively.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema and no annotations, the description partially covers return format ('A–F grade per site') and usage context. However, it lacks details on error handling, speed, or edge cases, leaving gaps for a simple tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with a description for the sole parameter. The tool description adds no new semantic detail beyond restating 'several domains/URLs'. Baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Run', the resource 'live web health & security check', and the scope 'several domains/URLs at once'. It distinguishes from the sibling tool 'check_website_health' by implying aggregation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides context by stating it is 'useful to audit a fleet of sites or compare deployments', which implicitly guides when to use it over a single-site check. However, it lacks explicit exclusions or alternative comparisons.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Run a LIVE web health & security check on a domain or URL and return an A–F grade with concrete fixes. Performs a real TLS handshake to read the SSL/TLS certificate (validity, trusted issuer, hostname match, days-to-expiry, self-signed detection), determines the negotiated TLS protocol version, checks whether plain HTTP redirects to HTTPS, evaluates the standard security response headers (Strict-Transport-Security/HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy), and measures basic availability and latency. Use this before launching a site, when auditing a deployment, or to verify a domain you are about to trust. The check is read-only — it never logs in or modifies the target.
| Name | Required | Description | Default |
|---|---|---|---|
| target | Yes | A domain (e.g. 'example.com') or full URL (e.g. 'https://example.com'). http(s):// is optional. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It thoroughly discloses all behaviors: read-only, never logs in or modifies target, performs TLS handshake, checks certificate validity, protocol version, redirects, security headers, and latency. This exceeds typical transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is moderately long but well-structured, with each sentence adding specific value. It could be slightly more concise, but it is not verbose and clearly communicates the tool's functionality.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity of a security check tool with many sub-checks and only one parameter, the description fully covers what the tool does, what it returns (grade, fixes), and its read-only nature. No output schema is needed as the return is explained adequately.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already describes the target parameter as a domain or full URL with 100% coverage. The description adds minimal extra meaning beyond stating that http(s):// is optional. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description explicitly states it performs a live web health and security check on a domain or URL, returning an A–F grade with concrete fixes. It lists specific checks (TLS, redirects, headers) and distinguishes from the sibling tool 'check_many' by focusing on a single target.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear usage scenarios: 'before launching a site, when auditing a deployment, or to verify a domain you are about to trust.' It does not explicitly mention when not to use or directly reference the sibling, but the context implies it's for single-target checks.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
v0.1.1check_manycheck_website_healthScored across 2 tools
The two tools have clearly distinct purposes: check_website_health performs a detailed check on a single domain, while check_many runs a batch check on multiple domains. There is no overlap.
Both tool names start with 'check_' but 'check_many' uses a quantifier instead of a noun, deviating from the typical verb_noun pattern seen in check_website_health. Still, the pattern is consistent overall.
With only two tools, the server covers single-domain and batch checks, but the scope feels minimal. A few more specialized tools (e.g., SSL-only check) would make the set more robust, but the current count is functional.
The single check tool is comprehensive, covering TLS, headers, redirects, and latency. The batch tool adds value. Missing are tools for specific subchecks, but the core workflow of auditing and comparing sites is well-covered.
Scan a website for vulnerabilities: OWASP Top 10, CVEs, SSL, headers - with plain-English fixes
SSL/TLS scanning, free Let's Encrypt issuance, and certificate-expiry monitoring.
Free anonymous website, DNS, email and TLS checks, plus monitor read and opt-in write access.
DNS lookups, health reports, SSL certs, security scans, GEO scoring, uptime checks
