# web-doctor 🩺

**Give it a domain, get an A–F health grade for its TLS, HTTPS and security headers — checked live.**

web-doctor opens a **real TLS connection** to the target and fetches its HTTP headers, then grades:

- 🔐 **TLS certificate** — validity & trusted issuer, hostname (SAN) match, **days until expiry**, self-signed / expired detection
- 🧩 **TLS version** — flags obsolete TLS 1.0/1.1; notes TLS 1.2 vs the stronger TLS 1.3
- ↪️ **HTTPS upgrade** — does plain `http://` 301-redirect to `https://`?
- 🛡️ **Security headers** — `Strict-Transport-Security` (HSTS), `Content-Security-Policy`, `X-Frame-Options`, `X-Content-Type-Options`, `Referrer-Policy`, `Permissions-Policy` — present **and** well-formed
- ⚡ **Availability** — HTTP status & response latency

…and returns a single **A–F grade** with a concrete **fix for every issue**.

It is read-only: it never logs in or changes anything on the target.

## Why an MCP / API and not just a script?

An LLM agent can't open a socket or finish a TLS handshake on its own. web-doctor does the live network work server-side and hands back a clean, graded verdict — so an agent (or a CI step) can audit a deployment in one call.

## Use it as an MCP server (free)

```json
{
  "mcpServers": {
    "web-doctor": { "command": "npx", "args": ["-y", "web-doctor-mcp"] }
  }
}
```

Tools:

- `check_website_health` — `{ "target": "example.com" }`
- `check_many` — `{ "targets": ["example.com", "github.com"] }`

Or connect over HTTP at `POST https://web-doctor.vercel.app/mcp`.

## Free HTTP API

```
GET https://web-doctor.vercel.app/check?target=example.com
GET https://web-doctor.vercel.app/check?target=https://github.com
GET https://web-doctor.vercel.app/check_many?targets=example.com,github.com,vercel.com
```

Rate-limited to 30 requests/hour/IP.

## Pay-per-call (x402) — no sign-up, no API key

The `/pro/*` routes are gated by [x402](https://x402.org). Your agent pays **$0.02 USDC** per call automatically and gets the result. Settles on-chain (Base) to the operator wallet.

```
GET https://web-doctor.vercel.app/pro/check?target=<domain>        # 402 → pay → result
GET https://web-doctor.vercel.app/pro/check_many?targets=...        # up to 50 targets
```

## Example output

```
🟢 A  —  github.com  (health score 96/100)
A — github.com is healthy: valid certificate, HTTPS enforced and the key security headers are in place.

TLS / certificate:
  • Protocol: TLSv1.3  cipher=TLS_AES_128_GCM_SHA256  handshake=84ms
  • Certificate: valid & trusted  issuer=CN=Sectigo ...  expires in 220d

HTTP:
  • Status 200  latency=140ms  server=github.com
  • HTTP→HTTPS redirect: yes

Security headers:
  ✅ Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
  ✅ Content-Security-Policy: default-src 'none'; ...
  ✅ X-Frame-Options: deny
  ✅ X-Content-Type-Options: nosniff
  ✅ Referrer-Policy: ...
  ✅ Permissions-Policy: ...
```

## Develop

```
npm install
npm run build
npm run test:engine        # live smoke test
npm run dev:http           # local server on :8080 (payments default ON; set X402_ENABLED=false to disable)
npm run dev:mcp            # stdio MCP server
```

### Environment (deploy)

| Var | Purpose |
|---|---|
| `X402_PAYTO` | receiving wallet (default set) |
| `X402_NETWORK` | `base` (default) |
| `X402_PRICE` | `$0.02` (default) |
| `X402_FACILITATOR_URL` | mainnet facilitator that settles on the chosen network (required to actually collect on mainnet) |
| `X402_ENABLED` | `false` to disable paid routes |

## License

MIT