HeaderGuard

Scan a website's HTTP security headers (HSTS, CSP, framing, COOP/CORP, cookies). Score + fixes.

Live service

• Web app and API: https://headerguard.mike-tusa.workers.dev/

• Pricing and plans: https://headerguard.mike-tusa.workers.dev/

• Support: digitalpromohub.support@gmail.com

Related MCP server: http-security-headers-mcp

Use it from an AI assistant (MCP)

HeaderGuard is a remote MCP server (Streamable HTTP) at https://headerguard.mike-tusa.workers.dev/mcp. Tools: scan_headers.

Most MCP clients (Claude Desktop, Cursor, Cline, Windsurf) accept this config:

{
  "mcpServers": {
    "headerguard": {
      "type": "http",
      "url": "https://headerguard.mike-tusa.workers.dev/mcp"
    }
  }
}

Clients that only support stdio can bridge with npx mcp-remote https://headerguard.mike-tusa.workers.dev/mcp. VS Code uses a servers key instead of mcpServers.

The server.json file is the MCP Registry manifest for this server.

Run your own copy

Requires Node.js 20+ and a Cloudflare account.

npm install
npx wrangler dev        # local dev server

wrangler.toml is a template: create your own KV namespaces / D1 databases / rate-limit namespaces and replace the <PLACEHOLDER> values before npx wrangler deploy. Any secrets the Worker reads go in wrangler secret put (or .dev.vars locally), never in the repo.

License

MIT (c) Digital Promo Hub. See LICENSE.