mcpbeat Sign in

HeaderGuard MCP Server

by workers-mike-tusa-headerguard Your server? Claim it
answering

HeaderGuard is answering right now. Last checked 13 min ago. It exposes 1 tools.

Scan a website's HTTP security headers (HSTS, CSP, framing, COOP/CORP, cookies). Score + fixes.

Uptime history 48 hours of history
48 hours agonow
100.0%
Uptime 24h
91 of 91 checks
1
Tools
read from the server
59 ms
Response time
average over 24h
open, no key
Access
streamable-http

Nothing serious here today

Today is the operative word: we check HeaderGuard every 15 minutes and re-read its code on every release. Watch it and you find out the day that stops being true.

Three servers free · no card

Connect this server

Endpoint below is the one we actually reach during checks — not the one copied from a README. Last verified 13 min ago.

run in your terminal
claude mcp add headerguard --transport http https://headerguard.mike-tusa.workers.dev/mcp
~/Library/Application Support/Claude/claude_desktop_config.json
{
  "mcpServers": {
    "headerguard": {
      "url": "https://headerguard.mike-tusa.workers.dev/mcp"
    }
  }
}
~/.codex/config.toml
[mcp_servers.headerguard]
url = "https://headerguard.mike-tusa.workers.dev/mcp"
.cursor/mcp.json
{
  "mcpServers": {
    "headerguard": {
      "url": "https://headerguard.mike-tusa.workers.dev/mcp"
    }
  }
}
.vscode/mcp.json
{
  "mcpServers": {
    "headerguard": {
      "url": "https://headerguard.mike-tusa.workers.dev/mcp"
    }
  }
}

Available tools 1

Read directly from the server with tools/list, grouped by what they act on. If a tool disappears, we record the date.

scan
scan_headers
Scan the HTTP security headers of a public website. Returns a 0–100 score and A+–F grade (HTTPS 10, HSTS 15, CSP 25, framing 10, X-Content-Type-Options 10, Referrer-Policy 10, Permissions-Policy 5, COOP 5, CORP 5, cookies 5, minus up to 5 for version-leak headers; without HTTPS the score is capped at 39), each header's status and notes, recommended fix headers, and a link to the full report with copy-paste snippets for nginx, Apache, Cloudflare, Netlify, Vercel and Express. Read-only: it sends ordinary GET requests to the site (following up to 10 redirects, each safety-checked) and never reads page bodies. Same engine and scoring as the HeaderGuard JSON API (GET /api/scan).

Endpoints

URLTransportStateLatencyChecked
https://headerguard.mike-tusa.workers.dev/mcp streamable-http answering 54 ms 13 min ago

Alternatives to HeaderGuard

same job, measured the same way
Mozilla Observatory
by pipeworx-io

MDN HTTP Observatory — grade any website's HTTP security headers and get the specific fixes, from…

43 tools answering
MCP Server Security Audit
by joepangallo

Scan websites for security vulnerabilities, headers, TLS, and email security.

34 installs/wk local only
ScanLabsAI Security Scanner
by scanlabsai

Scan a website for vulnerabilities: OWASP Top 10, CVEs, SSL, headers - with plain-English fixes

33 installs/wk 8 tools answering
Security Headers
by basitalisandhu

Fetch a URL's response headers and grade CSP, HSTS, X-Frame-Options and related security headers.

local only
Unchore Defend
by smilemino

Grade a site's security headers with fixes and a badge; read logs or code for the defender.

local only
Detectzestack MCP
by mlugo-apx

Detect any website's tech stack, security headers, SSL, DNS and CVEs via DetectZeStack.

49 installs/wk local only
Jikida
by jikida

Security tools for your AI: scan, pentest, check headers, guard code and scan repos for secrets.

41 installs/wk local only
T
Tools
by workers-sebastiaan-ba3-mcpgateway

Doormat Capital's paid x402 safety tools (token scan, HTTP security headers) for AI agents.

4 tools answering

HeaderGuard — questions

Answers built from our own checks of this server.

What can HeaderGuard do?
It exposes 1 tools, read directly from the server on our last check. Among them: scan_headers. The full list with descriptions is on this page — we take it from the server itself via tools/list, not from a README. How MCP servers expose tools in the first place →
Is HeaderGuard working right now?
We send a real MCP handshake every 15 minutes. Over the last 24 hours 91 of 91 checks got a reply (100.0%), average response time 59 ms. The bar chart above shows every period we have measured.
How do I connect HeaderGuard?
Copy the ready config from this page — we generate it for Claude Code, Claude Desktop, Codex, Cursor and VS Code, each with the file path that client actually reads. It is a remote server, so there is nothing to install — the client connects to the address.
Does HeaderGuard need an API key?
No. HeaderGuard completed a full MCP handshake with us as an anonymous client and listed its tools without asking for anything. All 1 of them are readable on this page. This is what we observed, not what the docs claim.
How fast is HeaderGuard?
It answers our handshake in 59 ms on average, which is faster than 93% of all working MCP servers we measure. That puts it in the quick quarter of the ecosystem. The comparison comes from our own checks across the whole registry, every 15 minutes.