security_headers_check
ActiveTool of IA-QA — 130+ QA & Dev Tools for AI Agents
Analyse the HTTP security headers of a public URL OR of raw response headers you paste in. Grades each header (A–F) for: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, X-XSS-Protection, Cross-Origin-Opener-Policy, Cross-Origin-Resource-Policy, and Cross-Origin-Embedder-Policy. Returns an overall score (0–100), per-header grades, missing headers, and fix snippets for Express, Nginx, and Apache. For localhost/private targets the remote server cannot reach, pass the `headers` parameter instead of `url`.
Parameters schema
{
"type": "object",
"properties": {
"url": {
"type": "string",
"description": "Optional. Full public URL to check (e.g. https://example.com). Omit it entirely when using `headers`. The server cannot reach localhost/private IPs."
},
"headers": {
"description": "Optional, and sufficient on its own (no url needed). The response headers to grade, either as an object {\"strict-transport-security\": \"max-age=...\", ...} or as the raw header block pasted as a string (e.g. `curl -sI` output). Use this to audit a local server the remote MCP cannot reach."
}
}
}No endpoints wrapped at confidence ≥ 0.70.
Parent server
IA-QA — 130+ QA & Dev Tools for AI Agents
https://github.com/jcjamet/ia-qa
1/7 registries