Go-Live Check
Checks HTTP response headers you paste: 7 security checks with copy-paste fixes. No fetching.
Should I use this
Quality & Safety
A
Based on automated analysis of tool definitions and protocol compliance.
Context Cost
~3,891Tokens (tool definitions)
~9.8 KBTypical response size
Significant attention impact (3.04% of 128k context)
This is the approximate number of tokens consumed each time the server's tools are loaded into a model's context. Higher counts reduce the attention available for other tasks.
Install
One-Click Install
Add this to your `claude_desktop_config.json` file:
{
"mcpServers": {
"golive-check": {
"url": "https://dontdeployonfriday.com/mcp"
}
}
}Remote endpoints
https://dontdeployonfriday.com/mcpstreamable-httpWhat it can do
Tool inventory
Tools (4)
🟢 Read-only🟡 Write🔴 Delete⚪ Unknown
🟢analyze_headers(headers_raw, platform, config_text, paths_tested)
Check raw HTTP response headers from a deployment you already operate. Returns the same object as POST /v1/analyze. Unknown fields are ignored. A url field is not fetched. Nothing is stored. Nothing is for sale.
Input Schema
{
"type": "object",
"properties": {
"headers_raw": {
"type": "string",
"description": "Raw HTTP response headers from a deployment this agent already operates, including an optional status line, as curl -sI prints them. This server does not request a URL."
},
"platform": {
"type": "string",
"pattern": "^[a-z0-9_-]{1,32}$",
"description": "Platform whose config the caller can edit. A fix snippet is attached only for caddy, nginx, vercel, netlify, or nextjs. Any other declared platform, or an omitted platform, returns fix null. This server does not guess the platform from the Server header."
},
"config_text": {
"type": "string",
"description": "Optional config text. Not copied into the response. When platform is caddy and this is non-empty, GLC-HSTS-MISSING includes config_header present or absent for one Caddy Strict-Transport-Security form with max-age greater than 0, GLC-CSP-MISSING includes config_header present or absent for one Caddy Content-Security-Policy form with a non-empty quoted value, GLC-NOSNIFF-MISSING includes config_header present or absent for one Caddy X-Content-Type-Options form set to nosniff, GLC-FRAME-MISSING includes config_header present or absent for one Caddy X-Frame-Options form set to DENY or SAMEORIGIN, GLC-REFERRER-MISSING includes config_header present or absent for one Caddy Referrer-Policy form with a non-empty value, and GLC-SERVER-VERSION-LEAK includes config_header present or absent only when that text deletes both Server and X-Powered-By. One deletion is absent. GLC-CORS-WILDCARD-CREDENTIALS includes config_header present or absent for one Caddy > replace of Access-Control-Allow-Origin whose replacement is non-empty and is not *. A line that sets that header without >, and a deletion, are absent. A Content-Security-Policy frame-ancestors line does not count as X-Frame-Options. When platform is nginx and this is non-empty, GLC-HSTS-MISSING includes config_header present or absent for one nginx add_header Strict-Transport-Security line with max-age greater than 0, GLC-CSP-MISSING includes config_header present or absent for one nginx add_header Content-Security-Policy line whose quoted value is non-empty after trim, and GLC-NOSNIFF-MISSING includes config_header present or absent for one nginx add_header X-Content-Type-Options line whose quoted value is nosniff. Any other value is absent. GLC-FRAME-MISSING includes config_header present or absent for one nginx add_header X-Frame-Options line whose quoted value is DENY or SAMEORIGIN. Any other value is absent. Content-Security-Policy-Report-Only does not count. A Content-Security-Policy frame-ancestors line does not count as X-Frame-Options. An empty quoted value, or a quoted value that is only spaces, is absent. A value that contains {, }, or $ is absent. GLC-REFERRER-MISSING includes config_header present or absent for one nginx add_header Referrer-Policy line whose quoted value is non-empty after trim. After trim, the accepted lines are add_header Referrer-Policy \"<value>\" always; and add_header Referrer-Policy \"<value>\";. The semicolon is required. An empty quoted value, or a quoted value that is only spaces, is absent. A value that contains {, }, or $ is absent. When platform is nginx, the version-leak field is present only for both lines server_tokens off; and proxy_hide_header X-Powered-By;. One of those lines is absent. The CORS field is present for one add_header Access-Control-Allow-Origin line whose quoted value is non-empty after trim and is not *. When platform is vercel, JSON headers entries are scanned for HSTS, CSP, nosniff, frame, referrer, and Access-Control-Allow-Origin using those same value rules, and the version-leak field is absent because vercel.json cannot delete Server or X-Powered-By. When platform is netlify, an indented Header: value line is scanned the same way, and the version-leak field is absent. When platform is nextjs, a headers() key and value pair is scanned the same way, and the version-leak field is present only when poweredByHeader is false. A value that contains {, }, or $ is absent. The Caddy scans still run only when platform is caddy. Other config text is not checked. Do not include secret values."
},
"paths_tested": {
"type": "array",
"maxItems": 40,
"items": {
"type": "string",
"maxLength": 200
},
"description": "Optional paths. Accepted and not checked. This server does not request them."
}
},
"required": [
"headers_raw"
],
"additionalProperties": true
}Output Schema
{
"type": "object",
"properties": {
"schema": {
"const": "golive-check.analyze.v0"
},
"checked": {
"type": "array",
"items": {
"type": "string"
}
},
"findings": {
"type": "array",
"items": {
"type": "object",
"additionalProperties": false,
"required": [
"id",
"severity",
"why",
"evidence",
"fix"
],
"properties": {
"id": {
"type": "string"
},
"severity": {
"type": "string"
},
"why": {
"type": "string"
},
"evidence": {
"type": "string"
},
"fix": {
"anyOf": [
{
"type": "null"
},
{
"type": "object",
"additionalProperties": false,
"required": [
"platform",
"snippet",
"source_url",
"last_verified"
],
"properties": {
"platform": {
"type": "string"
},
"snippet": {
"type": "string"
},
"source_url": {
"type": "string"
},
"last_verified": {
"type": "string"
},
"note": {
"type": "string"
}
}
}
]
},
"config_header": {
"description": "On GLC-HSTS-MISSING, GLC-CSP-MISSING, GLC-NOSNIFF-MISSING, GLC-FRAME-MISSING, GLC-REFERRER-MISSING, GLC-SERVER-VERSION-LEAK, and GLC-CORS-WILDCARD-CREDENTIALS, when platform is caddy and config_text is a non-empty string. present or absent for that finding. GLC-HSTS-MISSING is also present or absent when platform is nginx and config_text is a non-empty string, for one nginx add_header Strict-Transport-Security line whose quoted value contains max-age= and an integer greater than 0. A value that contains {, }, or $ is absent. GLC-CSP-MISSING is also present or absent when platform is nginx and config_text is a non-empty string, for one nginx add_header Content-Security-Policy line whose quoted value is non-empty after trim. Content-Security-Policy-Report-Only does not count. An empty quoted value, or a quoted value that is only spaces, is absent. A value that contains {, }, or $ is absent. GLC-NOSNIFF-MISSING is also present or absent when platform is nginx and config_text is a non-empty string, for one nginx add_header X-Content-Type-Options line whose quoted value is nosniff. After trim, the accepted lines are add_header X-Content-Type-Options \"nosniff\" always; and add_header X-Content-Type-Options \"nosniff\";. The semicolon is required. Any other value is absent. A value that contains {, }, or $ is absent. GLC-FRAME-MISSING is also present or absent when platform is nginx and config_text is a non-empty string, for one nginx add_header X-Frame-Options line whose quoted value is DENY or SAMEORIGIN. After trim, the accepted lines are add_header X-Frame-Options \"DENY\" always;, add_header X-Frame-Options \"SAMEORIGIN\" always;, add_header X-Frame-Options \"DENY\";, and add_header X-Frame-Options \"SAMEORIGIN\";. The semicolon is required. Any other value is absent. A value that contains {, }, or $ is absent. A Content-Security-Policy frame-ancestors line does not count. GLC-REFERRER-MISSING is also present or absent when platform is nginx and config_text is a non-empty string, for one nginx add_header Referrer-Policy line whose quoted value is non-empty after trim. After trim, the accepted lines are add_header Referrer-Policy \"<value>\" always; and add_header Referrer-Policy \"<value>\";. The semicolon is required. An empty quoted value, or a quoted value that is only spaces, is absent. A value that contains {, }, or $ is absent. When platform is nginx, the version-leak field is present only for both lines server_tokens off; and proxy_hide_header X-Powered-By;. One of those lines is absent. The CORS field is present for one add_header Access-Control-Allow-Origin line whose quoted value is non-empty after trim and is not *. When platform is vercel, JSON headers entries are scanned for HSTS, CSP, nosniff, frame, referrer, and Access-Control-Allow-Origin using those same value rules, and the version-leak field is absent because vercel.json cannot delete Server or X-Powered-By. When platform is netlify, an indented Header: value line is scanned the same way, and the version-leak field is absent. When platform is nextjs, a headers() key and value pair is scanned the same way, and the version-leak field is present only when poweredByHeader is false. A value that contains {, }, or $ is absent. GLC-SERVER-VERSION-LEAK is present only when that text deletes both Server and X-Powered-By. One deletion is absent. GLC-CORS-WILDCARD-CREDENTIALS is present only when that text has one Caddy > replace of Access-Control-Allow-Origin whose replacement is non-empty and is not *. A line that sets the header without >, and a deletion, are absent. Omitted when config_text is absent. Omitted on the version leak and CORS when the platform is not caddy, including when the Server header says caddy. Omitted on GLC-HSTS-MISSING when the platform is not caddy, nginx, vercel, netlify, or nextjs, including when the Server header says nginx. Omitted on GLC-CSP-MISSING when the platform is not caddy, nginx, vercel, netlify, or nextjs, including when the Server header says nginx. Omitted on GLC-NOSNIFF-MISSING when the platform is not caddy, nginx, vercel, netlify, or nextjs, including when the Server header says nginx. Omitted on GLC-FRAME-MISSING when the platform is not caddy, nginx, vercel, netlify, or nextjs, including when the Server header says nginx. Omitted on GLC-REFERRER-MISSING when the platform is not caddy, nginx, vercel, netlify, or nextjs, including when the Server header says nginx. The finding is not cleared. The config text is not copied.",
"enum": [
"present",
"absent"
]
}
}
}
},
"parsed_header_count": {
"type": "integer",
"minimum": 0
},
"platform": {
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
]
},
"config_text": {
"enum": [
"absent",
"not_checked"
]
},
"paths_tested_count": {
"type": "integer",
"minimum": 0
},
"notes": {
"type": "array",
"items": {
"type": "string"
}
}
},
"required": [
"schema",
"checked",
"findings",
"parsed_header_count",
"platform",
"config_text",
"paths_tested_count",
"notes"
],
"additionalProperties": false
}🟢explain_finding(id)
Explain one finding id from the seven. Returns id, severity, why, and answer_page. answer_page is the CSP and clickjacking page for GLC-CSP-MISSING and GLC-FRAME-MISSING, and null for the other five. Unknown fields are ignored. A url field is not fetched. Nothing is stored. Nothing is for sale.
Input Schema
{
"type": "object",
"properties": {
"id": {
"type": "string",
"enum": [
"GLC-HSTS-MISSING",
"GLC-CSP-MISSING",
"GLC-NOSNIFF-MISSING",
"GLC-FRAME-MISSING",
"GLC-REFERRER-MISSING",
"GLC-SERVER-VERSION-LEAK",
"GLC-CORS-WILDCARD-CREDENTIALS"
],
"description": "One finding id from the seven. Unknown fields are ignored. A url field is not fetched."
}
},
"required": [
"id"
],
"additionalProperties": true
}Output Schema
{
"type": "object",
"properties": {
"id": {
"type": "string",
"enum": [
"GLC-HSTS-MISSING",
"GLC-CSP-MISSING",
"GLC-NOSNIFF-MISSING",
"GLC-FRAME-MISSING",
"GLC-REFERRER-MISSING",
"GLC-SERVER-VERSION-LEAK",
"GLC-CORS-WILDCARD-CREDENTIALS"
]
},
"severity": {
"type": "string",
"enum": [
"high",
"medium",
"low"
]
},
"why": {
"type": "string"
},
"answer_page": {
"description": "https://dontdeployonfriday.com/csp-and-clickjacking.html for GLC-CSP-MISSING and GLC-FRAME-MISSING. Null for the other five. This server does not fetch it.",
"anyOf": [
{
"type": "null"
},
{
"const": "https://dontdeployonfriday.com/csp-and-clickjacking.html"
}
]
}
},
"required": [
"id",
"severity",
"why",
"answer_page"
],
"additionalProperties": false
}🟢get_fix(id, platform)
Return the registry snippet for one finding id and one platform. The platforms are caddy, nginx, vercel, netlify, nextjs. The result is id and fix. fix has platform, snippet, source_url, and last_verified, and note when the registry file has one. An omitted or unknown platform returns fix null. Unknown fields are ignored. A url field is not fetched. source_url is not fetched. Nothing is stored. Nothing is for sale.
Input Schema
{
"type": "object",
"properties": {
"id": {
"type": "string",
"enum": [
"GLC-HSTS-MISSING",
"GLC-CSP-MISSING",
"GLC-NOSNIFF-MISSING",
"GLC-FRAME-MISSING",
"GLC-REFERRER-MISSING",
"GLC-SERVER-VERSION-LEAK",
"GLC-CORS-WILDCARD-CREDENTIALS"
],
"description": "One finding id from the seven. Unknown fields are ignored. A url field is not fetched."
},
"platform": {
"type": "string",
"pattern": "^[a-z0-9_-]{1,32}$",
"description": "Platform whose config the caller can edit. caddy, nginx, vercel, netlify, nextjs returns that registry snippet. Any other value, or an omitted platform, returns fix null. This server does not guess the platform from the Server header. source_url is a citation and is not fetched."
}
},
"required": [
"id"
],
"additionalProperties": true
}Output Schema
{
"type": "object",
"properties": {
"id": {
"type": "string",
"enum": [
"GLC-HSTS-MISSING",
"GLC-CSP-MISSING",
"GLC-NOSNIFF-MISSING",
"GLC-FRAME-MISSING",
"GLC-REFERRER-MISSING",
"GLC-SERVER-VERSION-LEAK",
"GLC-CORS-WILDCARD-CREDENTIALS"
]
},
"fix": {
"anyOf": [
{
"type": "null"
},
{
"type": "object",
"additionalProperties": false,
"required": [
"platform",
"snippet",
"source_url",
"last_verified"
],
"properties": {
"platform": {
"type": "string"
},
"snippet": {
"type": "string"
},
"source_url": {
"type": "string"
},
"last_verified": {
"type": "string"
},
"note": {
"type": "string"
}
}
}
]
}
},
"required": [
"id",
"fix"
],
"additionalProperties": false
}🟢report_feedback(id, outcome)
Report one finding id and one outcome. The outcomes are false_positive, fix_worked, fix_failed. The result is id, outcome, and stored false. Nothing is written: no file, no counter, and no log line. A note, a url, and headers are ignored. A url field is not fetched. This server does not guess the platform from the Server header. Nothing is for sale.
Input Schema
{
"type": "object",
"properties": {
"id": {
"type": "string",
"enum": [
"GLC-HSTS-MISSING",
"GLC-CSP-MISSING",
"GLC-NOSNIFF-MISSING",
"GLC-FRAME-MISSING",
"GLC-REFERRER-MISSING",
"GLC-SERVER-VERSION-LEAK",
"GLC-CORS-WILDCARD-CREDENTIALS"
],
"description": "One finding id from the seven. A note, a url, and headers are ignored. A url field is not fetched."
},
"outcome": {
"type": "string",
"enum": [
"false_positive",
"fix_worked",
"fix_failed"
],
"description": "Exactly one of false_positive, fix_worked, fix_failed. Any other value is unknown_outcome. Nothing is written."
}
},
"required": [
"id",
"outcome"
],
"additionalProperties": true
}Output Schema
{
"type": "object",
"properties": {
"id": {
"type": "string",
"enum": [
"GLC-HSTS-MISSING",
"GLC-CSP-MISSING",
"GLC-NOSNIFF-MISSING",
"GLC-FRAME-MISSING",
"GLC-REFERRER-MISSING",
"GLC-SERVER-VERSION-LEAK",
"GLC-CORS-WILDCARD-CREDENTIALS"
]
},
"outcome": {
"type": "string",
"enum": [
"false_positive",
"fix_worked",
"fix_failed"
]
},
"stored": {
"const": false
}
},
"required": [
"id",
"outcome",
"stored"
],
"additionalProperties": false
}Community
Evidence
Recent observations
verifiedversion not recorded4 tools