HTTP Header Policy Check — HSTS, CSP & Frame Declarations

io.github.kriton-devPublished by GitHub account kriton-devv1.0.4Updated Nov 7, 2026

Check seven declared HTTP security header families without returning raw values

The publisher's own server: check.tattoo: tattoo size and placement guide

VerifiedStreamable HTTPWeb executableSecurity & Monitoring

Overview

AI-generated overview

Remote Apify-hosted MCP server that lets an assistant check seven declared HTTP security header families on a site, without returning raw header values.

What you can do
  • Check declared HTTP security header families for a target site
  • Cover HSTS, Content-Security-Policy and frame-related declarations among the seven families
  • Report findings without returning raw header values
  • Run as a hosted Apify Actor endpoint rather than a local process
When to use it
Useful when you want an assistant to review a site's declared security header posture, such as HSTS, CSP or frame declarations, as a quick check during a security or compliance review.
Requirements
Remote streamable HTTP endpoint at mcp.apify.com. Authentication is required: either an Authorization header with a Bearer Apify API token or OAuth sign-in to Apify. Runs are billed to your Apify account.
Before you install
You must supply an Apify API token via the Authorization header or sign in with OAuth, so the assistant's connection carries your Apify credentials. Runs are billed to your Apify account at pay-per-event prices, so repeated checks cost money.

Installation

In SourceWeft

  1. Open HTTP Header Policy Check — HSTS, CSP & Frame Declarations in the dashboard and add it to a workspace.
  2. Connect the required credentials. They are stored privately and never shown on public pages.
  3. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.kriton-dev%2Fhttp-security-headers/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config. The client completes OAuth sign-in on first connect.

{
  "mcpServers": {
    "http-header-policy-check-hsts-csp-frame": {
      "type": "http",
      "url": "https://mcp.apify.com/?tools=hermeskd/http-security-headers"
    }
  }
}

Tools

0
This server asks you to sign in, so SourceWeft could not read its tools without an account and has not indexed them. What a connected account sees can depend on that account and its permissions.

Version history

1
  1. v1.0.4LatestNov 7, 2026

Score

67% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts

    Declare a GitHub repository with a README, or serve resource_documentation in the OAuth protected-resource metadata.

  • LicenseNot applicable

    A hosted service is used under its provider's terms, so no license is expected here. This check is left out of the percentage.

Other Check integrations

check.tattoo: tattoo size and placement guide

tattoo.checkOfficial publisher

check.tattoo: tattoo size and placement guide's hosted MCP server, published by check.tattoo; no sign-in required; Streamable HTTP; 5 tools.

Streamable HTTPWeb executable
5 toolsOct 24, 2026

iva.pt — EU VAT check (VIES) and Portuguese VAT law

pt.ivaOfficial publisher

Validates EU VAT numbers against VIES and returns Portuguese VAT Code (CIVA) and RITI articles, in Portuguese or English.

Streamable HTTPWeb executable
Business & Commerce4 toolsOct 30, 2026

Dirtsmith Evidence Quote Check

Published by GitHub account throttler300

A local MCP server that binds an assistant's citations to admitted source text with spans and can reject stale-hash references.

STDIODesktop only
Knowledge & MemoryNot validated yetNov 7, 2026

VOOPA Render Check

Published by GitHub account Voopa-Corp

Reviews a completed AI-generated video against its brief and recommends whether to edit, retry once, or change approach before paying for another render.

Streamable HTTPWeb executable
AI & ML2 toolsNov 7, 2026

United Kingdom Company Check

Published by GitHub account JusticeUA

Remote MCP server that lets an assistant run UK company checks — status, insolvency, LEI and sanctions data from official registers.

Streamable HTTPWeb executableAuth
Business & CommerceCredential requiredNov 7, 2026