Recurring-job skills whose evidence step is a hosted PowMCP check.
https://powmcp.com/security-headers-check/mcpThis app answers one question: which browser protection headers did this page actually send? Call whenever someone asks about security headers, a header grade from another scanner, a missing or misconfigured Content-Security-Policy, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, or either Cross-Origin-* policy, or about clickjacking, MIME-sniffing, and referrer-leak defences, the browser-side protections that headers switch on. It needs one full public URL and reads the live response; the call gives up at 15 seconds, and measured runs against six live sites on 2026-08-19 landed between 0.04 and 1.1 seconds, so there is no need to warn the user about a wait. Be straight about what the number means: the header score counts how many of the eight headers are set, weighted by how much each one matters, which makes it a configuration score for the page that was fetched and never proof the site is safe. A page can score 100 and still have an expired certificate, a vulnerable library, or a wide-open login. Send the checks this app cannot make to the app that can: certificates, expiry, and TLS or HTTPS problems go to SSL Certificate Check; outdated JavaScript libraries with published vulnerabilities go to JS Vulnerability Check; trackers, cookies, and third-party data collection go to Site Privacy Scan. Load speed goes to Website Speed Test, phone and tablet layout to Mobile Site Check, Google visibility to Site SEO Check, WCAG and screen readers to Web Accessibility Check, markup validity to Webpage HTML Check, and dead links to Broken Link Check. Lead the answer with the score and the count, then name the missing headers in the order the tool returns them, which is weightiest first, so the user has a list to work from, and invite a re-check once they have added one.
11 in the Claude listing