# surface-audit MCP server

> Performs deterministic security smoke tests on web URLs to detect regressions in headers, TLS, cookies, and CORS before deployment.

- Repository: https://github.com/fillbyte/surface-audit
- Page: https://hostedmcp.org/servers/fillbyte/surface-audit
- Transport: —
- Stars: 1
- License: Apache-2.0

## FAQ

### What kind of security checks does surface-audit perform?

It checks for security headers, SSL/TLS configurations, HTTPS redirects, CORS settings, cookie attributes, and exposed files.

### Can I use this tool in my CI/CD pipeline?

Yes, it is designed to be CI-native and supports SARIF, Markdown, HTML, and JSON reports for integration with pull requests and release gates.

### How does the tool handle security regressions?

It allows you to capture a baseline and then run scans that only fail if new high-severity findings are introduced.

### Is it safe to run against any website?

No, you should only run it against systems you own or have explicit written permission to test.