AI导哈

网站安全快照扫描服务

这是一个MCP服务器服务，允许Claude等AI助手直接扫描任意公网URL的HTTP安全响应头并执行安全审计，通过链上自动支付完成扣费，适用于网站安全检测场景。

  • by Seiya-wasabi
  • TypeScript
  • 本地部署
  • 更新于
在 GitHub 查看 Seiya-wasabi/mcp-server-security-snapshot

使用说明

mcp-server-security-snapshot

MCP server that exposes Website Security Snapshot API as a tool for Claude and other AI agents.

Scan any public URL's HTTP security headers directly from your AI assistant — payment settled automatically on-chain via x402 v2 (0.05 USDC on Base mainnet).

1.1.0 (2026-10-13): the API moved to x402 v2 on 2026-10-04 and 1.0.0 (v1 client) can no longer pay. npx -y mcp-server-security-snapshot picks up 1.1.0 automatically. Base Sepolia is no longer supported.

Tools Provided

Tool Description Cost
scan_security_headers Scan a URL's security headers (live, paid) 0.05 USDC
demo_security_snapshot Return a pre-baked example (free) Free

scan_security_headers

Checks:

  • HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy
  • HTTPS enforcement and redirect chain
  • Presence of security.txt, robots.txt, sitemap.xml

Setup

Requirements

  • A wallet with USDC on Base mainnet
  • To try the output without paying, use the free demo_security_snapshot tool

Claude Desktop

Add to claude_desktop_config.json (usually ~/Library/Application Support/Claude/ on macOS, %APPDATA%\Claude\ on Windows):

{
  "mcpServers": {
    "security-snapshot": {
      "command": "npx",
      "args": ["-y", "mcp-server-security-snapshot"],
      "env": {
        "WALLET_PRIVATE_KEY": "0xYOUR_PRIVATE_KEY"
      }
    }
  }
}

Run Directly

WALLET_PRIVATE_KEY=0x... npx mcp-server-security-snapshot

Environment Variables

Variable Required Default Description
WALLET_PRIVATE_KEY Yes — Private key of paying wallet (0x...)
NETWORK No base Only base (Base mainnet) is supported
API_BASE_URL No https://api.cybersecurity-japan.com Override API endpoint

Example Usage in Claude

Once configured, ask Claude:

"Check the security headers on https://example.com"

"Does https://mysite.com have HSTS and CSP enabled?"

"Audit the security hygiene of https://example.com and tell me what's missing"

Claude will call scan_security_headers, pay 0.05 USDC from your wallet, and return the results. If the payment is not accepted (for example, no USDC on Base), the tool returns Payment not accepted: with the reason. Error responses are not charged.

Security Note

Your WALLET_PRIVATE_KEY is used to sign USDC transactions. Use a dedicated wallet with only enough USDC for your intended usage. Do not use your main wallet.

Links

License

MIT

相关 MCP