About Security Snapshot
Security Snapshot is an MCP server for checking HTTP security headers on public URLs. It offers a live scan tool and a free example result, with live scans paid in USDC on Base.
Key features
- 01Scan HTTP security headers
- 02Check HTTPS enforcement and redirects
- 03Check common security-related files
- 04View a free sample snapshot
- 05Pay for live scans with USDC
Use cases
- 01Review a public website’s header configuration
- 02Check whether a site enables HSTS and CSP
MCP support
Exposes `scan_security_headers` for live URL checks and `demo_security_snapshot` for a pre-built example to MCP clients. Live scans charge 0.05 USDC on Base mainnet.
Configuration
Local server config is the same for every client. Copy it into your client’s MCP config file.
npx -y mcp-server-security-snapshotWALLET_PRIVATE_KEYSecretNETWORKLocal servers need a runtime on your machine (e.g. Node.js 18+). Config file locations differ by client; see your client’s docs.
Tools
Local servers expose tools only once running on your machine, and the maintainer has not provided a tool list.
Details
From the project READMEmcp-server-security-snapshot
MCP server that exposes Website Security Snapshot API as a tool for Claude and other AI agents.
Scan any public URL's HTTP security headers directly from your AI assistant — payment settled automatically on-chain via x402 v2 (0.05 USDC on Base mainnet).
1.1.0 (2026-10-13): the API moved to x402 v2 on 2026-10-04 and 1.0.0 (v1 client) can no longer pay.
npx -y mcp-server-security-snapshotpicks up 1.1.0 automatically. Base Sepolia is no longer supported.
Tools Provided
| Tool | Description | Cost |
|---|---|---|
scan_security_headers | Scan a URL's security headers (live, paid) | 0.05 USDC |
demo_security_snapshot | Return a pre-baked example (free) | Free |
scan_security_headers
Checks:
- HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy
- HTTPS enforcement and redirect chain
- Presence of
security.txt,robots.txt,sitemap.xml
Setup
Requirements
- A wallet with USDC on Base mainnet
- To try the output without paying, use the free
demo_security_snapshottool
Claude Desktop
Add to claude_desktop_config.json (usually ~/Library/Application Support/Claude/ on macOS, %APPDATA%\Claude\ on Windows):
{
"mcpServers": {
"security-snapshot": {
"command": "npx",
"args": ["-y", "mcp-server-security-snapshot"],
"env": {
"WALLET_PRIVATE_KEY": "0xYOUR_PRIVATE_KEY"
}
}
}
}
Run Directly
WALLET_PRIVATE_KEY=0x... npx mcp-server-security-snapshot
Environment Variables
| Variable | Required | Default | Description |
|---|---|---|---|
WALLET_PRIVATE_KEY | Yes | — | Private key of paying wallet (0x...) |
NETWORK | No | base | Only base (Base mainnet) is supported |
API_BASE_URL | No | https://api.cybersecurity-japan.com | Override API endpoint |
Example Usage in Claude
Once configured, ask Claude:
"Check the security headers on https://example.com"
"Does https://mysite.com have HSTS and CSP enabled?"
"Audit the security hygiene of https://example.com and tell me what's missing"
Claude will call scan_security_headers, pay 0.05 USDC from your wallet, and return the results. If the payment is not accepted (for example, no USDC on Base), the tool returns Payment not accepted: with the reason. Error responses are not charged.
Security Note
Your WALLET_PRIVATE_KEY is used to sign USDC transactions. Use a dedicated wallet with only enough USDC for your intended usage. Do not use your main wallet.
Links
License
MIT
Comments
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.