Security Tools

com.rangercheckPublished by rangercheck.comOfficial publisherv1.0.0Updated Oct 24, 2026

Free front-end security check for any website: a grade plus the secrets and keys it exposes.

VerifiedStreamable HTTPWeb executableSecurity & Monitoring

Overview

AI-generated overview

Remote MCP server that runs a free front-end security check on any website and returns a letter grade plus specific findings.

What you can do
  • Scan a website's front-end for exposed secrets and keys
  • Get a letter grade from A to F with specific findings
  • Answer questions about leaked API keys, exposed Stripe, AWS or OpenAI keys, or publicly readable databases
  • Report how a site's web security is configured
When to use it
Useful when you want a quick, free check of a site's client-side exposure before trusting or integrating it, or when investigating whether a domain leaks keys or secrets in its front-end code.
Requirements
A remote endpoint at rangercheck.com over streamable HTTP; no packages, environment variables, headers or authentication are declared.
Before you install
The scan is performed by a third-party service, so the domain you submit is sent to rangercheck.com. Results are a front-end check only and should not be treated as a full security audit.

Installation

In SourceWeft

  1. Open Security Tools in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/com.rangercheck%2Fsecurity-tools/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "security-tools": {
      "type": "http",
      "url": "https://rangercheck.com/api/mcp"
    }
  }
}

Tools

1

scan_security

Run a free front-end security check on any website and get a letter grade (A to F) plus specific findings. Answers questions like 'is example.com leaking API keys or secrets in its front-end code', 'does this site expose a Stripe/AWS/OpenAI key or a publicly readable database', or 'how is this website's client-side security'. Reads only what the site serves publicly; never logs in or changes anything.

Parametersdomainrequired

Version history

1
  1. v1.0.0LatestSep 16, 2026

Score

83% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts

    Declare a GitHub repository with a README, or serve resource_documentation in the OAuth protected-resource metadata.

  • LicenseNot applicable

    A hosted service is used under its provider's terms, so no license is expected here. This check is left out of the percentage.