web-doctor 🩺

Give it a domain, get an A–F health grade for its TLS, HTTPS and security headers — checked live.

web-doctor opens a real TLS connection to the target and fetches its HTTP headers, then grades:

• 🔐 TLS certificate — validity & trusted issuer, hostname (SAN) match, days until expiry, self-signed / expired detection
• 🧩 TLS version — flags obsolete TLS 1.0/1.1; notes TLS 1.2 vs the stronger TLS 1.3
• ↪️ HTTPS upgrade — does plain http:// 301-redirect to https://?
• 🛡️ Security headers — Strict-Transport-Security (HSTS), Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy — present and well-formed
• ⚡ Availability — HTTP status & response latency

…and returns a single A–F grade with a concrete fix for every issue.

It is read-only: it never logs in or changes anything on the target.

Why an MCP / API and not just a script?

An LLM agent can't open a socket or finish a TLS handshake on its own. web-doctor does the live network work server-side and hands back a clean, graded verdict — so an agent (or a CI step) can audit a deployment in one call.

Use it as an MCP server (free)

{
  "mcpServers": {
    "web-doctor": { "command": "npx", "args": ["-y", "web-doctor-mcp"] }
  }
}

Tools:

• check_website_health — { "target": "example.com" }
• check_many — { "targets": ["example.com", "github.com"] }

Or connect over HTTP at POST https://web-doctor.vercel.app/mcp.

Free HTTP API

GET https://web-doctor.vercel.app/check?target=example.com
GET https://web-doctor.vercel.app/check?target=https://github.com
GET https://web-doctor.vercel.app/check_many?targets=example.com,github.com,vercel.com

Rate-limited to 30 requests/hour/IP.

Pay-per-call (x402) — no sign-up, no API key

The /pro/* routes are gated by x402. Your agent pays $0.02 USDC per call automatically and gets the result. Settles on-chain (Base) to the operator wallet.

GET https://web-doctor.vercel.app/pro/check?target=<domain>        # 402 → pay → result
GET https://web-doctor.vercel.app/pro/check_many?targets=...        # up to 50 targets

Example output

🟢 A  —  github.com  (health score 96/100)
A — github.com is healthy: valid certificate, HTTPS enforced and the key security headers are in place.

TLS / certificate:
  • Protocol: TLSv1.3  cipher=TLS_AES_128_GCM_SHA256  handshake=84ms
  • Certificate: valid & trusted  issuer=CN=Sectigo ...  expires in 220d

HTTP:
  • Status 200  latency=140ms  server=github.com
  • HTTP→HTTPS redirect: yes

Security headers:
  ✅ Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
  ✅ Content-Security-Policy: default-src 'none'; ...
  ✅ X-Frame-Options: deny
  ✅ X-Content-Type-Options: nosniff
  ✅ Referrer-Policy: ...
  ✅ Permissions-Policy: ...

Develop

npm install
npm run build
npm run test:engine        # live smoke test
npm run dev:http           # local server on :8080 (payments default ON; set X402_ENABLED=false to disable)
npm run dev:mcp            # stdio MCP server

Environment (deploy)

Var	Purpose
X402_PAYTO	receiving wallet (default set)
X402_NETWORK	base (default)
X402_PRICE	$0.02 (default)
X402_FACILITATOR_URL	mainnet facilitator that settles on the chosen network (required to actually collect on mainnet)
X402_ENABLED	false to disable paid routes

License

MIT