# mcp-server-security-snapshot

MCP server that exposes [Website Security Snapshot API](https://api.cybersecurity-japan.com) as a tool for Claude and other AI agents.

Scan any public URL's HTTP security headers directly from your AI assistant — payment settled automatically on-chain via x402 v2 (0.05 USDC on Base mainnet).

> **1.1.0 (2026-10-13):** the API moved to x402 v2 on 2026-10-04 and 1.0.0 (v1 client) can no longer pay. `npx -y mcp-server-security-snapshot` picks up 1.1.0 automatically. Base Sepolia is no longer supported.

## Tools Provided

| Tool | Description | Cost |
|------|-------------|------|
| `scan_security_headers` | Scan a URL's security headers (live, paid) | 0.05 USDC |
| `demo_security_snapshot` | Return a pre-baked example (free) | Free |

### `scan_security_headers`

Checks:
- HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy
- HTTPS enforcement and redirect chain
- Presence of `security.txt`, `robots.txt`, `sitemap.xml`

## Setup

### Requirements

- A wallet with USDC on Base mainnet
- To try the output without paying, use the free `demo_security_snapshot` tool

### Claude Desktop

Add to `claude_desktop_config.json` (usually `~/Library/Application Support/Claude/` on macOS, `%APPDATA%\Claude\` on Windows):

```json
{
  "mcpServers": {
    "security-snapshot": {
      "command": "npx",
      "args": ["-y", "mcp-server-security-snapshot"],
      "env": {
        "WALLET_PRIVATE_KEY": "0xYOUR_PRIVATE_KEY"
      }
    }
  }
}
```

### Run Directly

```bash
WALLET_PRIVATE_KEY=0x... npx mcp-server-security-snapshot
```

### Environment Variables

| Variable | Required | Default | Description |
|----------|----------|---------|-------------|
| `WALLET_PRIVATE_KEY` | **Yes** | — | Private key of paying wallet (`0x...`) |
| `NETWORK` | No | `base` | Only `base` (Base mainnet) is supported |
| `API_BASE_URL` | No | `https://api.cybersecurity-japan.com` | Override API endpoint |

## Example Usage in Claude

Once configured, ask Claude:

> "Check the security headers on https://example.com"

> "Does https://mysite.com have HSTS and CSP enabled?"

> "Audit the security hygiene of https://example.com and tell me what's missing"

Claude will call `scan_security_headers`, pay 0.05 USDC from your wallet, and return the results. If the payment is not accepted (for example, no USDC on Base), the tool returns `Payment not accepted:` with the reason. Error responses are not charged.

## Security Note

Your `WALLET_PRIVATE_KEY` is used to sign USDC transactions. Use a dedicated wallet with only enough USDC for your intended usage. Do not use your main wallet.

## Links

- [API docs](https://api.cybersecurity-japan.com/docs)
- [OpenAPI spec](https://api.cybersecurity-japan.com/openapi.json)
- [x402 protocol](https://github.com/coinbase/x402)

## License

MIT