check_security_headers
Check a web page's security HTTP response headers for vulnerabilities in CSP, HSTS, X-Frame-Options, and more to identify missing security protections.
Instructions
Inspect security-related HTTP response headers for the page: CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and XSS-Protection.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| url | No | URL to check (default: current page URL) | |
| tabId | No | Target tab ID (defaults to currently active tab) | |
| apiKey | No | API key for authentication if enabled |
Implementation Reference
- src/tools/audit.ts:150-163 (handler)The handler function for check_security_headers tool. It sends a 'check_security_headers' command via the WebSocket bridge and returns the result (security headers data) or an error.
async ({ url, tabId, apiKey }) => { const result = await bridge.sendCommand({ command: 'check_security_headers', params: { url }, tabId, apiKey, timeout: LONG_TIMEOUT, }); if (!result.success) { return { content: [{ type: 'text', text: `Error: ${result.error?.message}` }], isError: true }; } return { content: [{ type: 'text', text: JSON.stringify(result.data, null, 2) }] }; } ); - src/tools/audit.ts:146-149 (schema)Input schema for check_security_headers: optional URL string, optional tabId number, and optional apiKey string.
url: z.string().optional().describe('URL to check (default: current page URL)'), tabId: z.number().optional().describe('Target tab ID (defaults to currently active tab)'), apiKey: z.string().optional().describe('API key for authentication if enabled'), }, - src/tools/audit.ts:142-163 (registration)The tool is registered as 'check_security_headers' via server.tool() in the registerAuditTools function within src/tools/audit.ts.
server.tool( 'check_security_headers', 'Inspect security-related HTTP response headers for the page: CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and XSS-Protection.', { url: z.string().optional().describe('URL to check (default: current page URL)'), tabId: z.number().optional().describe('Target tab ID (defaults to currently active tab)'), apiKey: z.string().optional().describe('API key for authentication if enabled'), }, async ({ url, tabId, apiKey }) => { const result = await bridge.sendCommand({ command: 'check_security_headers', params: { url }, tabId, apiKey, timeout: LONG_TIMEOUT, }); if (!result.success) { return { content: [{ type: 'text', text: `Error: ${result.error?.message}` }], isError: true }; } return { content: [{ type: 'text', text: JSON.stringify(result.data, null, 2) }] }; } );