Checks HTTP response headers you paste: 7 security checks with copy-paste fixes. No fetching.
Maintain this server? Claim it
Call this server's tools from your browser. Nothing to install.
Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.
Tool list from our last check. Connect live to refresh it.
Check raw HTTP response headers from a deployment you already operate. Returns the same object as POST /v1/analyze. Unknown fields are ignored. A url field is not fetched. Nothing is stored. Nothing is for sale.
Raw HTTP response headers from a deployment this agent already operates, including an optional status line, as curl -sI prints them. This server does not request a URL.
Platform whose config the caller can edit. A fix snippet is attached only for caddy, nginx, vercel, netlify, or nextjs. Any other declared platform, or an omitted platform, returns fix null. This server does not guess the platform from the Server header.
Optional config text. Not copied into the response. When platform is caddy and this is non-empty, GLC-HSTS-MISSING includes config_header present or absent for one Caddy Strict-Transport-Security form with max-age greater than 0, GLC-CSP-MISSING includes config_header present or absent for one Caddy Content-Security-Policy form with a non-empty quoted value, GLC-NOSNIFF-MISSING includes config_header present or absent for one Caddy X-Content-Type-Options form set to nosniff, GLC-FRAME-MISSING includes config_header present or absent for one Caddy X-Frame-Options form set to DENY or SAMEORIGIN, GLC-REFERRER-MISSING includes config_header present or absent for one Caddy Referrer-Policy form with a non-empty value, and GLC-SERVER-VERSION-LEAK includes config_header present or absent only when that text deletes both Server and X-Powered-By. One deletion is absent. GLC-CORS-WILDCARD-CREDENTIALS includes config_header present or absent for one Caddy > replace of Access-Control-Allow-Origin whose replacement is non-empty and is not *. A line that sets that header without >, and a deletion, are absent. A Content-Security-Policy frame-ancestors line does not count as X-Frame-Options. When platform is nginx and this is non-empty, GLC-HSTS-MISSING includes config_header present or absent for one nginx add_header Strict-Transport-Security line with max-age greater than 0, GLC-CSP-MISSING includes config_header present or absent for one nginx add_header Content-Security-Policy line whose quoted value is non-empty after trim, and GLC-NOSNIFF-MISSING includes config_header present or absent for one nginx add_header X-Content-Type-Options line whose quoted value is nosniff. Any other value is absent. GLC-FRAME-MISSING includes config_header present or absent for one nginx add_header X-Frame-Options line whose quoted value is DENY or SAMEORIGIN. Any other value is absent. Content-Security-Policy-Report-Only does not count. A Content-Security-Policy frame-ancestors line does not count as X-Frame-Options. An empty quoted value, or a quoted value that is only spaces, is absent. A value that contains {, }, or $ is absent. GLC-REFERRER-MISSING includes config_header present or absent for one nginx add_header Referrer-Policy line whose quoted value is non-empty after trim. After trim, the accepted lines are add_header Referrer-Policy "<value>" always; and add_header Referrer-Policy "<value>";. The semicolon is required. An empty quoted value, or a quoted value that is only spaces, is absent. A value that contains {, }, or $ is absent. When platform is nginx, the version-leak field is present only for both lines server_tokens off; and proxy_hide_header X-Powered-By;. One of those lines is absent. The CORS field is present for one add_header Access-Control-Allow-Origin line whose quoted value is non-empty after trim and is not *. When platform is vercel, JSON headers entries are scanned for HSTS, CSP, nosniff, frame, referrer, and Access-Control-Allow-Origin using those same value rules, and the version-leak field is absent because vercel.json cannot delete Server or X-Powered-By. When platform is netlify, an indented Header: value line is scanned the same way, and the version-leak field is absent. When platform is nextjs, a headers() key and value pair is scanned the same way, and the version-leak field is present only when poweredByHeader is false. A value that contains {, }, or $ is absent. The Caddy scans still run only when platform is caddy. Other config text is not checked. Do not include secret values.
Optional paths. Accepted and not checked. This server does not request them.
Check raw HTTP response headers from a deployment you already operate. Returns the same object as POST /v1/analyze. Unknown fields are ignored. A url field is not fetched. Nothing is stored. Nothing is for sale.
| Argument | Type | Description |
|---|---|---|
| platform | string | Platform whose config the caller can edit. A fix snippet is attached only for caddy, nginx, vercel, netlify, or nextjs. Any other declared platform, or an omitted platform, returns fix null. This server does not guess the platform from the Server header. |
| config_text | string | Optional config text. Not copied into the response. When platform is caddy and this is non-empty, GLC-HSTS-MISSING includes config_header present or absent for one Caddy Strict-Transport-Security form with max-age greater than 0, GLC-CSP-MISSING includes config_header present or absent for one Caddy Content-Security-Policy form with a non-empty quoted value, GLC-NOSNIFF-MISSING includes config_header present or absent for one Caddy X-Content-Type-Options form set to nosniff, GLC-FRAME-MISSING includes config_header present or absent for one Caddy X-Frame-Options form set to DENY or SAMEORIGIN, GLC-REFERRER-MISSING includes config_header present or absent for one Caddy Referrer-Policy form with a non-empty value, and GLC-SERVER-VERSION-LEAK includes config_header present or absent only when that text deletes both Server and X-Powered-By. One deletion is absent. GLC-CORS-WILDCARD-CREDENTIALS includes config_header present or absent for one Caddy > replace of Access-Control-Allow-Origin whose replacement is non-empty and is not *. A line that sets that header without >, and a deletion, are absent. A Content-Security-Policy frame-ancestors line does not count as X-Frame-Options. When platform is nginx and this is non-empty, GLC-HSTS-MISSING includes config_header present or absent for one nginx add_header Strict-Transport-Security line with max-age greater than 0, GLC-CSP-MISSING includes config_header present or absent for one nginx add_header Content-Security-Policy line whose quoted value is non-empty after trim, and GLC-NOSNIFF-MISSING includes config_header present or absent for one nginx add_header X-Content-Type-Options line whose quoted value is nosniff. Any other value is absent. GLC-FRAME-MISSING includes config_header present or absent for one nginx add_header X-Frame-Options line whose quoted value is DENY or SAMEORIGIN. Any other value is absent. Content-Security-Policy-Report-Only does not count. A Content-Security-Policy frame-ancestors line does not count as X-Frame-Options. An empty quoted value, or a quoted value that is only spaces, is absent. A value that contains {, }, or $ is absent. GLC-REFERRER-MISSING includes config_header present or absent for one nginx add_header Referrer-Policy line whose quoted value is non-empty after trim. After trim, the accepted lines are add_header Referrer-Policy "<value>" always; and add_header Referrer-Policy "<value>";. The semicolon is required. An empty quoted value, or a quoted value that is only spaces, is absent. A value that contains {, }, or $ is absent. When platform is nginx, the version-leak field is present only for both lines server_tokens off; and proxy_hide_header X-Powered-By;. One of those lines is absent. The CORS field is present for one add_header Access-Control-Allow-Origin line whose quoted value is non-empty after trim and is not *. When platform is vercel, JSON headers entries are scanned for HSTS, CSP, nosniff, frame, referrer, and Access-Control-Allow-Origin using those same value rules, and the version-leak field is absent because vercel.json cannot delete Server or X-Powered-By. When platform is netlify, an indented Header: value line is scanned the same way, and the version-leak field is absent. When platform is nextjs, a headers() key and value pair is scanned the same way, and the version-leak field is present only when poweredByHeader is false. A value that contains {, }, or $ is absent. The Caddy scans still run only when platform is caddy. Other config text is not checked. Do not include secret values. |
| headers_raw* | string | Raw HTTP response headers from a deployment this agent already operates, including an optional status line, as curl -sI prints them. This server does not request a URL. |
| paths_tested | array | Optional paths. Accepted and not checked. This server does not request them. |
{
"type": "object",
"required": [
"headers_raw"
],
"properties": {
"platform": {
"type": "string",
"pattern": "^[a-z0-9_-]{1,32}$",
"description": "Platform whose config the caller can edit. A fix snippet is attached only for caddy, nginx, vercel, netlify, or nextjs. Any other declared platform, or an omitted platform, returns fix null. This server does not guess the platform from the Server header."
},
"config_text": {
"type": "string",
"description": "Optional config text. Not copied into the response. When platform is caddy and this is non-empty, GLC-HSTS-MISSING includes config_header present or absent for one Caddy Strict-Transport-Security form with max-age greater than 0, GLC-CSP-MISSING includes config_header present or absent for one Caddy Content-Security-Policy form with a non-empty quoted value, GLC-NOSNIFF-MISSING includes config_header present or absent for one Caddy X-Content-Type-Options form set to nosniff, GLC-FRAME-MISSING includes config_header present or absent for one Caddy X-Frame-Options form set to DENY or SAMEORIGIN, GLC-REFERRER-MISSING includes config_header present or absent for one Caddy Referrer-Policy form with a non-empty value, and GLC-SERVER-VERSION-LEAK includes config_header present or absent only when that text deletes both Server and X-Powered-By. One deletion is absent. GLC-CORS-WILDCARD-CREDENTIALS includes config_header present or absent for one Caddy > replace of Access-Control-Allow-Origin whose replacement is non-empty and is not *. A line that sets that header without >, and a deletion, are absent. A Content-Security-Policy frame-ancestors line does not count as X-Frame-Options. When platform is nginx and this is non-empty, GLC-HSTS-MISSING includes config_header present or absent for one nginx add_header Strict-Transport-Security line with max-age greater than 0, GLC-CSP-MISSING includes config_header present or absent for one nginx add_header Content-Security-Policy line whose quoted value is non-empty after trim, and GLC-NOSNIFF-MISSING includes config_header present or absent for one nginx add_header X-Content-Type-Options line whose quoted value is nosniff. Any other value is absent. GLC-FRAME-MISSING includes config_header present or absent for one nginx add_header X-Frame-Options line whose quoted value is DENY or SAMEORIGIN. Any other value is absent. Content-Security-Policy-Report-Only does not count. A Content-Security-Policy frame-ancestors line does not count as X-Frame-Options. An empty quoted value, or a quoted value that is only spaces, is absent. A value that contains {, }, or $ is absent. GLC-REFERRER-MISSING includes config_header present or absent for one nginx add_header Referrer-Policy line whose quoted value is non-empty after trim. After trim, the accepted lines are add_header Referrer-Policy \"<value>\" always; and add_header Referrer-Policy \"<value>\";. The semicolon is required. An empty quoted value, or a quoted value that is only spaces, is absent. A value that contains {, }, or $ is absent. When platform is nginx, the version-leak field is present only for both lines server_tokens off; and proxy_hide_header X-Powered-By;. One of those lines is absent. The CORS field is present for one add_header Access-Control-Allow-Origin line whose quoted value is non-empty after trim and is not *. When platform is vercel, JSON headers entries are scanned for HSTS, CSP, nosniff, frame, referrer, and Access-Control-Allow-Origin using those same value rules, and the version-leak field is absent because vercel.json cannot delete Server or X-Powered-By. When platform is netlify, an indented Header: value line is scanned the same way, and the version-leak field is absent. When platform is nextjs, a headers() key and value pair is scanned the same way, and the version-leak field is present only when poweredByHeader is false. A value that contains {, }, or $ is absent. The Caddy scans still run only when platform is caddy. Other config text is not checked. Do not include secret values."
},
"headers_raw": {
"type": "string",
"description": "Raw HTTP response headers from a deployment this agent already operates, including an optional status line, as curl -sI prints them. This server does not request a URL."
},
"paths_tested": {
"type": "array",
"items": {
"type": "string",
"maxLength": 200
},
"maxItems": 40,
"description": "Optional paths. Accepted and not checked. This server does not request them."
}
},
"additionalProperties": true
}Explain one finding id from the seven. Returns id, severity, why, and answer_page. answer_page is the CSP and clickjacking page for GLC-CSP-MISSING and GLC-FRAME-MISSING, and null for the other five. Unknown fields are ignored. A url field is not fetched. Nothing is stored. Nothing is for sale.
| Argument | Type | Description |
|---|---|---|
| id* | string | One finding id from the seven. Unknown fields are ignored. A url field is not fetched. |
{
"type": "object",
"required": [
"id"
],
"properties": {
"id": {
"enum": [
"GLC-HSTS-MISSING",
"GLC-CSP-MISSING",
"GLC-NOSNIFF-MISSING",
"GLC-FRAME-MISSING",
"GLC-REFERRER-MISSING",
"GLC-SERVER-VERSION-LEAK",
"GLC-CORS-WILDCARD-CREDENTIALS"
],
"type": "string",
"description": "One finding id from the seven. Unknown fields are ignored. A url field is not fetched."
}
},
"additionalProperties": true
}Return the registry snippet for one finding id and one platform. The platforms are caddy, nginx, vercel, netlify, nextjs. The result is id and fix. fix has platform, snippet, source_url, and last_verified, and note when the registry file has one. An omitted or unknown platform returns fix null. Unknown fields are ignored. A url field is not fetched. source_url is not fetched. Nothing is stored. Nothing is for sale.
| Argument | Type | Description |
|---|---|---|
| id* | string | One finding id from the seven. Unknown fields are ignored. A url field is not fetched. |
| platform | string | Platform whose config the caller can edit. caddy, nginx, vercel, netlify, nextjs returns that registry snippet. Any other value, or an omitted platform, returns fix null. This server does not guess the platform from the Server header. source_url is a citation and is not fetched. |
{
"type": "object",
"required": [
"id"
],
"properties": {
"id": {
"enum": [
"GLC-HSTS-MISSING",
"GLC-CSP-MISSING",
"GLC-NOSNIFF-MISSING",
"GLC-FRAME-MISSING",
"GLC-REFERRER-MISSING",
"GLC-SERVER-VERSION-LEAK",
"GLC-CORS-WILDCARD-CREDENTIALS"
],
"type": "string",
"description": "One finding id from the seven. Unknown fields are ignored. A url field is not fetched."
},
"platform": {
"type": "string",
"pattern": "^[a-z0-9_-]{1,32}$",
"description": "Platform whose config the caller can edit. caddy, nginx, vercel, netlify, nextjs returns that registry snippet. Any other value, or an omitted platform, returns fix null. This server does not guess the platform from the Server header. source_url is a citation and is not fetched."
}
},
"additionalProperties": true
}Report one finding id and one outcome. The outcomes are false_positive, fix_worked, fix_failed. The result is id, outcome, and stored false. Nothing is written: no file, no counter, and no log line. A note, a url, and headers are ignored. A url field is not fetched. This server does not guess the platform from the Server header. Nothing is for sale.
| Argument | Type | Description |
|---|---|---|
| id* | string | One finding id from the seven. A note, a url, and headers are ignored. A url field is not fetched. |
| outcome* | string | Exactly one of false_positive, fix_worked, fix_failed. Any other value is unknown_outcome. Nothing is written. |
{
"type": "object",
"required": [
"id",
"outcome"
],
"properties": {
"id": {
"enum": [
"GLC-HSTS-MISSING",
"GLC-CSP-MISSING",
"GLC-NOSNIFF-MISSING",
"GLC-FRAME-MISSING",
"GLC-REFERRER-MISSING",
"GLC-SERVER-VERSION-LEAK",
"GLC-CORS-WILDCARD-CREDENTIALS"
],
"type": "string",
"description": "One finding id from the seven. A note, a url, and headers are ignored. A url field is not fetched."
},
"outcome": {
"enum": [
"false_positive",
"fix_worked",
"fix_failed"
],
"type": "string",
"description": "Exactly one of false_positive, fix_worked, fix_failed. Any other value is unknown_outcome. Nothing is written."
}
},
"additionalProperties": true
}