drheaderplus-mcp

MCP server for DrHeaderPlus — audit HTTP security headers from AI assistants.

Scans URLs or analyzes raw headers against security best practices: OWASP, CSP, HSTS, cookie flags, CORS misconfiguration, and more.

Available Tools

Tool Parameters

scan_url

• url (required): The URL to scan (must include scheme, e.g. https://example.com)
• preset (optional): Ruleset preset name
• cross_origin_isolated (optional): Enable COEP/COOP checks (default: false)

analyze_headers

• headers (required): HTTP response headers as key-value pairs
• preset (optional): Ruleset preset name
• cross_origin_isolated (optional): Enable COEP/COOP checks (default: false)

scan_bulk

• urls (required): List of URLs to scan
• preset (optional): Ruleset preset name
• cross_origin_isolated (optional): Enable COEP/COOP checks (default: false)

Installation

Using uvx (recommended, no install needed)

uvx drheaderplus-mcp

Using pip

pip install drheaderplus-mcp

Configuration

Claude Desktop

Add to your claude_desktop_config.json:

Using uvx:

{
  "mcpServers": {
    "drheaderplus": {
      "command": "uvx",
      "args": ["drheaderplus-mcp"]
    }
  }
}

Using pip installation:

{
  "mcpServers": {
    "drheaderplus": {
      "command": "drheaderplus-mcp"
    }
  }
}

Claude Code

claude mcp add drheaderplus -- uvx drheaderplus-mcp

VS Code

Add to your .vscode/mcp.json:

{
  "servers": {
    "drheaderplus": {
      "command": "uvx",
      "args": ["drheaderplus-mcp"]
    }
  }
}

Debugging

Use the MCP inspector to test the server:

npx @modelcontextprotocol/inspector uvx drheaderplus-mcp

License

MIT