HTTP Headers Security MCP Server

A Model Context Protocol (MCP) server for analyzing HTTP security headers against OWASP best practices.

Features

• Analyze HTTP response headers for security issues
• Identify potentially dangerous headers that should be removed
• Recommend missing security headers that should be added
• Based on OWASP security header best practices
• Easy integration with Claude and other MCP-compatible AI assistants

Installation

# Install globally
npm install -g gc-http-headers-security-mcp

# Or run directly without installing
npx gc-http-headers-security-mcp

Usage

Command Line

npx gc-http-headers-security-mcp

With Claude Desktop

Add to your claude_desktop_config.json:

{
  "mcpServers": {
    "http-headers-security": {
      "command": "npx",
      "args": ["-y", "gc-http-headers-security-mcp"]
    }
  }
}

With Other MCP Clients

For other MCP clients, you can configure them to use this server with:

npx gc-http-headers-security-mcp

API

The server provides the following tool:

• analyze-http-header: Analyze HTTP headers for a specified URL

Example Response

{
  "removeHeaders": [
    "Server: Apache/2.4.41",
    "X-Powered-By: PHP/7.4.3"
  ],
  "addedHeaders": [
    "Content-Security-Policy: default-src 'self'",
    "X-Frame-Options: DENY",
    "X-Content-Type-Options: nosniff",
    "Strict-Transport-Security: max-age=31536000; includeSubDomains"
  ]
}

License

Apache-2.0