io.github.kriton-dev/http-security-headers

HTTP Header Policy Check — HSTS, CSP & Frame Declarations

Is the HTTP Header Policy Check MCP server down? No. It is up and needs auth (HTTP 401), probed 2026-11-11.

Check seven declared HTTP security header families without returning raw values

needs auth probed 2026-11-14 · unchanged since 2026-11-11 · HTTP 401 · Bearer

Streamable HTTP error: Error POSTing to endpoint: {"error":"invalid_token","error_description":"Missing or invalid access token. Pass an Apify API token in the

Endpoint: https://mcp.apify.com/?tools=hermeskd/http-security-headers (streamable-http)
Host: mcp.apify.com
Getting access: OAuth with dynamic client registration. A client such as Claude Code, Cursor or npx mcpcost auth https://mcp.apify.com/?tools=hermeskd/http-security-headers registers itself and opens the consent page; the publisher has nothing to set up for you.
Authorization server console-backend.apify.com, PKCE S256, grants authorization_code, refresh_token, urn:ietf:params:oauth:grant-type:device_code.
Scopes full_api_access.
Read from the server's public OAuth metadata, without a token. Method.
Website: https://apify.com/hermeskd/http-security-headers
Registry: active, updated 2026-11-06 · registry entry

Compare this server with others.

More servers

Other registry entries on mcp.apify.com, the ones next to this name; all of them.

GitHub Repository Metrics — Stars, Forks & Issue Counts io.github.kriton-dev/github-repository-metrics · needs auth
Greenhouse Jobs — Live Openings, Offices and Apply Links io.github.kriton-dev/greenhouse-jobs · needs auth
Hacker News Metrics — Story Scores & Comment Counts io.github.kriton-dev/hacker-news-story-metrics · needs auth
HTTP GET Request — Bulk Text Responses, Status & SHA-256 io.github.kriton-dev/http-get-response · needs auth
Image Background Remover — Small U2NetP, PNG Base64 io.github.kriton-dev/image-background-remover · needs auth
Image Converter — Static JPEG, PNG & WebP Resize/Compress io.github.kriton-dev/image-format-converter · needs auth
Image Metadata Remover — EXIF/GPS Scrub with Pixel Checks io.github.kriton-dev/image-metadata-remover · needs auth
Image to Text — OCR Lines, Word Boxes & Confidence Scores io.github.kriton-dev/image-to-text · needs auth

Servers that mention security.

Arketo ai.arketo/arketo · needs auth
Helixar Security ai.helixar/mcp · needs auth
ai.kernora/agent-sec · alive
IntoDNS.ai DNS & Email Security Scanner ai.intodns/scanner · alive
SOAR Record Gateway ai.lateos/soar-record-gateway · needs auth
Occludra — MCP Gateway (AI Security Gateway) ai.occludra/mcp-gateway · server error
RFP.ai ai.rfp/rfp-ai · needs auth
ai.sealgate/gateway · needs auth

Badge for the README

The result of the latest probe, the tool count and the token cost. The feed has an entry for every probe that changed them.

Atom feed

A mail when this server changes

Stops answering, comes back, tool set or cost changes. One confirmation mail first, a stop link in every mail.

For the publisher

The server answers HTTP 401 to an unauthenticated initialize, so the probe cannot list its tools. That is correct for a private server. Some public servers answer initialize and tools/list without credentials and ask for auth on tool calls only; those get a token count here.

Fixed something? Probe it now, with the same steps as the daily run. This page updates with the next daily run.