HeaderGuard

dev.workers.mike-tusa.headerguardPublished by headerguard.mike-tusa.workers.devOfficial publisherv0.4.0Updated Oct 24, 2026

Scan a website's HTTP security headers (HSTS, CSP, framing, COOP/CORP, cookies). Score + fixes.

VerifiedStreamable HTTPWeb executableSecurity & Monitoring

Overview

AI-generated overview

HeaderGuard lets an assistant scan a public website's HTTP security headers and get a 0–100 score, an A+–F grade, and fix suggestions.

What you can do
Scan a public website's HTTP security headers, covering HTTPS, HSTS, CSP, framing, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP, CORP and cookies, with deductions for version-leak headers and a score cap when HTTPS is missing.
When to use it
Useful when you want a quick, repeatable check of a site's security header posture and a graded result with suggested fixes, for example while reviewing a deployment or auditing a public site.
Requirements
A remote endpoint reached over streamable HTTP; no local runtime or package is needed. It works without a key; an optional Authorization header carrying a Bearer license token raises limits.
Before you install
The optional Authorization header is a secret license token and should be supplied only as a header, never shared. Scans target public websites, so only scan sites you are authorized to check.

Installation

In SourceWeft

  1. Open HeaderGuard in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/dev.workers.mike-tusa.headerguard%2Fheaderguard/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "headerguard": {
      "type": "http",
      "url": "https://headerguard.mike-tusa.workers.dev/mcp"
    }
  }
}

Tools

1

scan_headers

Scan a website's HTTP security headers (HSTS, CSP, framing, COOP/CORP/COEP, cookies)

Scan the HTTP security headers of a public website. Returns a 0–100 score and A+–F grade (HTTPS 10, HSTS 15, CSP 25, framing 10, X-Content-Type-Options 10, Referrer-Policy 10, Permissions-Policy 5, COOP 5, CORP 5, cookies 5, minus up to 5 for version-leak headers; without HTTPS the score is capped at 39), each header's status and notes, recommended fix headers, and a link to the full report with copy-paste snippets for nginx, Apache, Cloudflare, Netlify, Vercel and Express. Read-only: it sends ordinary GET requests to the site (following up to 10 redirects, each safety-checked) and never reads page bodies. Same engine and scoring as the HeaderGuard JSON API (GET /api/scan).

Parametersurlrequiredinclude_raw

Version history

1
  1. v0.4.0LatestOct 9, 2026

Score

83% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts

    Declare a GitHub repository with a README, or serve resource_documentation in the OAuth protected-resource metadata.

  • LicenseNot applicable

    A hosted service is used under its provider's terms, so no license is expected here. This check is left out of the percentage.