# Corrie Site Check

> Score any public site's HTTPS, TLS certificate and security headers, with plain fixes. No auth.

- name: io.corrie/site-check
- version: 1.1.0
- connection class: R0 (autonomous)
- trust: 82/100 flags: no-repository
- quality: 77/100 (good)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/io.corrie%2Fsite-check
- tools: https://api.protogrid.dev/v1/servers/io.corrie%2Fsite-check/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "site-check": {
      "type": "http",
      "url": "https://corrie.io/mcp"
    }
  }
}
```


## Trust

- hygiene: 80
- liveness: 99
- freshness: 100
- provenance: 55
- drivers: +dns-namespace +website +reachable +uptime-97% +updated-4d-ago -no-repository
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 77/100 (good)

### protocol: 75 (weight 25)

- warn `protocol.modern`: newest supported version is 2025-06-18; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
- n/a `protocol.stateless`: only applies to 2026-07-28 servers
- pass `protocol.transport`: streamable HTTP
- n/a `protocol.list_ttl`: only applies to 2026-07-28 servers

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 93 (weight 30)

- pass `tools.descriptions`: every tool has a description
- warn `tools.description_length`: 1 tools have descriptions over 1,024 characters, which crowds the context
- pass `tools.schemas`: every tool has an object input schema
- pass `tools.annotations`: 1 of 1 tools declare readOnlyHint or destructiveHint
- pass `tools.directory_hints`: every tool declares readOnlyHint, destructiveHint, idempotentHint and openWorldHint
- pass `tools.token_cost`: about 503 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: 50 (weight 15)

- pass `stability.changes`: 1 tool changes in 30 days
- fail `stability.rug_pull`: 1 tools kept their name but changed most of their description in 30 days; review before trusting them

### dependencies: n/a (weight 15)

- n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: no npm or PyPI package

- tools: 1, about 503 tokens to load them all
- tool set hash: f62364614206b158f44371cea9e28ad5
- tools last changed: 2026-10-14T22:03:55.102Z
- badge: [![protogrid quality](https://protogrid.dev/badge/io.corrie/site-check.svg)](https://protogrid.dev/servers/io.corrie/site-check)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

- 2026-10-14 `check_website` changed (description, inputSchema, outputSchema) **meaning changed**
  - before: Loads the homepage of a public website once, the way a visitor's browser would, and reports its HTTPS setup and security headers (HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and others). Returns a score out of 100, a verdict, and each finding with its severity and a plain-English fix. Use it for questions like 'is example.com secure?' or 'what security headers is my site missing?'. It does not log in, submit forms, scan ports or test for vulnerabilities, and it refuses private or internal addresses.
  - after: Loads the homepage of one public website over HTTPS, the way a visitor's browser would, and reports its HTTPS setup, TLS certificate and security headers (Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, cookie flags, mixed content and server banners). Returns a score from 0 to 100, a verdict, the TLS certificate issuer and expiry date, and each finding with a severity (critical, high, medium or low) and a plain-English fix that includes nginx or Cloudflare examples. Use it for questions like 'is example.com secure?', 'what security headers is my site missing?', 'when does this site's certificate expire?' or 'why does Chrome say my site is not secure?'. Input is a bare domain (example.com) or an https:// address. A bare domain checks the homepage; if you include a path, that one page is loaded instead. It does not log in, submit forms, scan ports, crawl other pages or test for vulnerabilities, and nothing is stored. It refuses private, internal and local addresses, plain http://, ports other than 443 and addresses with a user name; those come back as an isError result with a message saying what to change. A check usually takes 1 to 10 seconds. Running it twice on the same site gives the same result unless the site changed. Read corrie://docs/scoring for how the score and verdict work.

Full history: https://api.protogrid.dev/v1/servers/io.corrie%2Fsite-check/changes

## Remotes

- https://corrie.io/mcp (streamable-http, auth none, reachable true, uptime30d 0.9677419)

## Packages

_none_

## Tools (1)

- `check_website`: Loads the homepage of one public website over HTTPS, the way a visitor's browser would, and reports its HTTPS setup, TLS certificate and security headers (Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, cookie flags, mixed content and server banners). Returns a score from 0 to 100, a verdict, the TLS certificate issuer and expiry date, and each finding with a severity (critical, high, medium or low) and a plain-English fix that includes nginx or Cloudflare examples. Use it for questions like 'is example.com secure?', 'what security headers is my site missing?', 'when does this site's certificate expire?' or 'why does Chrome say my site is not secure?'. Input is a bare domain (example.com) or an https:// address. A bare domain checks the homepage; if you include a path, that one page is loaded instead. It does not log in, submit forms, scan ports, crawl other pages or test for vulnerabilities, and nothing is stored. It refuses private, internal and local addresses, plain http://, ports other than 443 and addresses with a user name; those come back as an isError result with a message saying what to change. A check usually takes 1 to 10 seconds. Running it twice on the same site gives the same result unless the site changed. Read corrie://docs/scoring for how the score and verdict work.