Scan a website's HTTP security headers (HSTS, CSP, framing, COOP/CORP, cookies). Score + fixes.
Connect Remote server
claude mcp add --transport http headerguard https://headerguard.mike-tusa.workers.dev/mcp --header "Authorization: Bearer <YOUR_API_KEY>"
{
"mcpServers": {
"headerguard": {
"url": "https://headerguard.mike-tusa.workers.dev/mcp",
"headers": {
"Authorization": "Bearer <YOUR_API_KEY>"
}
}
}
}
{
"servers": {
"headerguard": {
"type": "http",
"url": "https://headerguard.mike-tusa.workers.dev/mcp",
"headers": {
"Authorization": "Bearer <YOUR_API_KEY>"
}
}
}
}
Settings > Connectors > Add custom connector
URL: https://headerguard.mike-tusa.workers.dev/mcp
Replace the values in angle brackets with your own. Keys stay on your machine; we never see them.
Tools 1 found in our last check
scan_headersScan the HTTP security headers of a public website. Returns a 0–100 score and A+–F grade (HTTPS 10, HSTS 15, CSP 25, framing 10, X-Content-Type-Options 10, Referrer-Policy 10, Permissions-Policy 5, COOP 5, CORP 5, cookies 5, minus up to 5 for version-leak headers; without HTTPS…
Headers
| Name | Description |
|---|---|
AuthorizationOptional, secret | Optional. 'Bearer HDRG-…' (HeaderGuard Pro license) for higher limits. Works without a key. |
Details
| Endpoint | https://headerguard.mike-tusa.workers.dev/mcp (Streamable HTTP) |
| First published | 9 Oct 2026 |
| Last updated | 9 Oct 2026 |
| Registry name | dev.workers.mike-tusa.headerguard/headerguard |
More security servers See all
Listing data from the official MCP registry. Status and tools from NestDaddy's daily check. Browse all MCP servers.
