HeaderGuard MCP server
Commit Oct 18, 2026Scans website HTTP security headers like HSTS and CSP to provide security scores and code snippets for fixes.
Also known as miketusa-ctrl/headerguard
- Stars
- 0
- Tools
- —
- Downloads, 30 days
- —
- Latest version
- —
- Last commit
- Oct 18, 2026
- License
- MIT
What is HeaderGuard MCP?
HeaderGuard scans website HTTP security headers like HSTS and CSP to provide security scores and code snippets for fixes.
Summary generated from the project's README
About HeaderGuard MCP server
Analyzing website security configurations through an AI assistant is what HeaderGuard enables for developers and security researchers. By using the scan_headers tool, users can evaluate critical HTTP security headers such as HSTS, CSP, framing, COOP/CORP, and cookie settings. The server provides security scores and specific code snippets to help implement necessary fixes for identified vulnerabilities.
This is a remote MCP server that connects via Streamable HTTP. You can integrate it into Cursor, Windsurf, or Cline by adding the provided URL to your configuration files. Claude Desktop users can connect by adding it as a custom connector, while those using local-only clients can utilize the mcp-remote bridge. If you prefer to host your own version, you will need Node.js 22+ and a Cloudflare account to deploy the worker.
What you can do with it
- 1Audit website security headersAsk your AI assistant to scan a specific URL to check for missing or misconfigured security headers.
- 2Generate security fix codeRequest code snippets from the AI to resolve security issues found during a header scan.
- 3Evaluate security posture scoresUse the tool to receive a quantitative score regarding the current security state of a web domain.
Written from the project's README. Every use case is checked against a quote from it.
README
View on GitHubHeaderGuard
Scan a website's HTTP security headers (HSTS, CSP, framing, COOP/CORP, cookies). Score + fixes.
Live service
- Web app and API: https://headerguard.mike-tusa.workers.dev/
- Pricing: https://headerguard.mike-tusa.workers.dev/
- Support: digitalpromohub.support@gmail.com
Use it from an AI assistant (MCP)
HeaderGuard is a remote MCP server (Streamable HTTP) at https://headerguard.mike-tusa.workers.dev/mcp. Tools: scan_headers.
Cursor and Windsurf accept this config:
{
"mcpServers": {
"headerguard": {
"type": "http",
"url": "https://headerguard.mike-tusa.workers.dev/mcp"
}
}
}
Cline (MCP Servers > Remote Servers, or cline_mcp_settings.json) needs "type": "streamableHttp":
{
"mcpServers": {
"headerguard": {
"type": "streamableHttp",
"url": "https://headerguard.mike-tusa.workers.dev/mcp"
}
}
}
Claude Desktop: open Settings > Connectors, choose "Add custom connector" and paste https://headerguard.mike-tusa.workers.dev/mcp. Or, for clients that only support local (stdio) servers, use the mcp-remote bridge: npx mcp-remote https://headerguard.mike-tusa.workers.dev/mcp.
VS Code uses a servers key instead of mcpServers.
The server.json file is the MCP Registry manifest for this server.
Run your own copy
Requires Node.js 22+ and a Cloudflare account.
npm install
npx wrangler@4 dev # local dev server
wrangler.toml is a template: create your own KV namespaces / D1 databases / rate-limit namespaces and replace the <PLACEHOLDER> values before npx wrangler@4 deploy. Any secrets the Worker reads go in wrangler secret put (or .dev.vars locally), never in the repo.
Optional Worker secrets (leave unset if you do not need them): RAPIDAPI_PROXY_SECRET (only needed if you sell the API through RapidAPI; it must match the X-RapidAPI-Proxy-Secret header RapidAPI adds).
License
MIT (c) Digital Promo Hub. See LICENSE.
HeaderGuard MCP questions
What security headers can HeaderGuard scan?
The server scans HSTS, CSP, framing, COOP/CORP, and cookies.
How do I use HeaderGuard with Claude Desktop?
Open Settings, go to Connectors, choose 'Add custom connector', and paste the server URL.
What are the requirements to run my own copy of the server?
You need Node.js version 22 or higher and a Cloudflare account.