loading…
Search for a command to run...
loading…
An MCP server that gives Claude and other AI agents the ability to audit any public URL's HTTP security headers. What it checks: * HSTS, CSP, X-Frame-Options, X
An MCP server that gives Claude and other AI agents the ability to audit any public URL's HTTP security headers. What it checks: * HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy * HTTPS enforcement and redirect chain depth * Presence of security.txt, robots.txt, sitemap.xml Payment model: * 0.05 USDC per scan, paid automatically on Base via the x402 proto
MCP server that exposes Website Security Snapshot API as a tool for Claude and other AI agents.
Scan any public URL's HTTP security headers directly from your AI assistant — payment settled automatically on-chain via x402 (0.05 USDC on Base).
Network status: Currently on Base Sepolia testnet. Mainnet (Base) goes live 2026-03-28. Use
"NETWORK": "base-sepolia"for testing before that date; switch to"NETWORK": "base"on 2026-03-28.
| Tool | Description | Cost |
|---|---|---|
scan_security_headers |
Scan a URL's security headers (live, paid) | 0.05 USDC |
demo_security_snapshot |
Return a pre-baked example (free) | Free |
scan_security_headersChecks:
security.txt, robots.txt, sitemap.xmlAdd to claude_desktop_config.json (usually ~/Library/Application Support/Claude/ on macOS, %APPDATA%\Claude\ on Windows):
{
"mcpServers": {
"security-snapshot": {
"command": "npx",
"args": ["-y", "mcp-server-security-snapshot"],
"env": {
"WALLET_PRIVATE_KEY": "0xYOUR_PRIVATE_KEY",
"NETWORK": "base"
}
}
}
}
For testnet (free USDC from faucet):
{
"env": {
"WALLET_PRIVATE_KEY": "0xYOUR_TESTNET_KEY",
"NETWORK": "base-sepolia"
}
}
WALLET_PRIVATE_KEY=0x... NETWORK=base npx mcp-server-security-snapshot
| Variable | Required | Default | Description |
|---|---|---|---|
WALLET_PRIVATE_KEY |
Yes | — | Private key of paying wallet (0x...) |
NETWORK |
No | base |
base or base-sepolia |
API_BASE_URL |
No | https://api.cybersecurity-japan.com |
Override API endpoint |
Once configured, ask Claude:
"Check the security headers on https://example.com"
"Does https://mysite.com have HSTS and CSP enabled?"
"Audit the security hygiene of https://example.com and tell me what's missing"
Claude will call scan_security_headers, pay 0.05 USDC from your wallet, and return the results.
Your WALLET_PRIVATE_KEY is used to sign USDC transactions. Use a dedicated wallet with only enough USDC for your intended usage. Do not use your main wallet.
MIT
Добавь это в claude_desktop_config.json и перезапусти Claude Desktop.
{
"mcpServers": {
"mcp-server-security-snapshot": {
"command": "npx",
"args": []
}
}
}