HeaderGuard

dev.workers.mike-tusa.headerguard/headerguardVersion 0.4.0

Scan a website's HTTP security headers (HSTS, CSP, framing, COOP/CORP, cookies). Score + fixes.

Status

Responds173 msNov 14, 2026, 14:28 UTCAnswered our handshake without sign-in.

We could not refresh it, so this page shows the last copy.

Data from the official MCP Registry, checked by run.zero. How we check

Streamable HTTP

https://headerguard.mike-tusa.workers.dev/mcpResponds173 msNov 14, 2026, 14:28 UTC

No sign-in

claude mcp add --transport http headerguard https://headerguard.mike-tusa.workers.dev/mcp

1
2
3

Settings > Connectors > Add custom connector
Name: headerguard
Remote MCP server URL: https://headerguard.mike-tusa.workers.dev/mcp

{
  "mcpServers": {
    "headerguard": {
      "url": "https://headerguard.mike-tusa.workers.dev/mcp"
    }
  }
}

code --add-mcp '{"name":"headerguard","type":"http","url":"https://headerguard.mike-tusa.workers.dev/mcp"}'

Built your own server? run.zero hosts MCP servers on European infrastructure.

1 tools

Tools of HeaderGuard
	Description		Read-only	Idempotent	Open world
`scan_headers`Scan the HTTP security headers of a public website. Returns a 0–100 score and A+–F grade (HTTPS 10, HSTS 15, CSP 25, framing 10, X-Content-Type-Options 10, Referrer-Policy 10, Permissions-Policy 5, COOP 5, CORP 5, cookies 5, minus up to 5 for version-leak headers; without HTTPS the score is capped at 39), each header's status and notes, recommended fix headers, and a link to the full report with copy-paste snippets for nginx, Apache, Cloudflare, Netlify, Vercel and Express. Read-only: it sends ordinary GET requests to the site (following up to 10 redirects, each safety-checked) and never reads page bodies. Same engine and scoring as the HeaderGuard JSON API (GET /api/scan).	Scan the HTTP security headers of a public website. Returns a 0–100 score and A+–F grade (HTTPS 10, HSTS 15, CSP 25, framing 10, X-Content-Type-Options 10, Referrer-Policy 10, Permissions-Policy 5, COOP 5, CORP 5, cookies 5, minus up to 5 for version-leak headers; without HTTPS the score is capped at 39), each header's status and notes, recommended fix headers, and a link to the full report with copy-paste snippets for nginx, Apache, Cloudflare, Netlify, Vercel and Express. Read-only: it sends ordinary GET requests to the site (following up to 10 redirects, each safety-checked) and never reads page bodies. Same engine and scoring as the HeaderGuard JSON API (GET /api/scan).	No	Yes	Yes	Yes

Registry status: Active
Published: Oct 9, 2026
Updated: Oct 9, 2026
Website: https://headerguard.mike-tusa.workers.dev/⁠ (opens in a new tab)
Repository: Not given
Categories (suggested): SecuritySuggested categories are assigned automatically from the registry text and may be wrong. Verified operators can correct them.
GDPR: Not declared