Skip to content

Corrie Site Check

by corrie.io · remote · no sign-in to list tools · v1.1.0 · published by io.corrie

Score any public site's HTTPS, TLS certificate and security headers, with plain fixes. No auth.

Changes · 1
CompareRegistry entry

1 tool: 1 change things.

Scanned Oct 21, 2026

No check matched anything in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http site-check https://corrie.io/mcp

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

1 tool

Changes things 1Claude Code: ask
  • check_websiteLoads the homepage of one public website over HTTPS, the way a visitor's browser would, and reports its HTTPS setup, TLS certificate and security headers (Strict-Transport-Security…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Loads the homepage of one public website over HTTPS, the way a visitor's browser would, and reports its HTTPS setup, TLS certificate and security headers (Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, cookie flags, mixed content and server banners). Returns a score from 0 to 100, a verdict, the TLS certificate issuer and expiry date, and each finding with a severity (critical, high, medium or low) and a plain-English fix that includes nginx or Cloudflare examples. Use it for questions like 'is example.com secure?', 'what security headers is my site missing?', 'when does this site's certificate expire?' or 'why does Chrome say my site is not secure?'. Input is a bare domain (example.com) or an https:// address. A bare domain checks the homepage; if you include a path, that one page is loaded instead. It does not log in, submit forms, scan ports, crawl other pages or test for vulnerabilities, and nothing is stored. It refuses private, internal and local addresses, plain http://, ports other than 443 and addresses with a user name; those come back as an isError result with a message saying what to change. A check usually takes 1 to 10 seconds. Running it twice on the same site gives the same result unless the site changed. Read corrie://docs/scoring for how the score and verdict work.

    Annotations the server declares

    • title: Check a website
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.1.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http site-check https://corrie.io/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [],
    "ask": [
      "mcp__site-check__check_website"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as site-check. Review it before you use it.