Web Doctor — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Web Doctor (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Give it a domain, get an A–F health grade for its TLS, HTTPS and security headers — checked live.
web-doctor opens a real TLS connection to the target and fetches its HTTP headers, then grades:
http:// 301-redirect to https://?Strict-Transport-Security (HSTS), Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy — present and well-formed…and returns a single A–F grade with a concrete fix for every issue.
It is read-only: it never logs in or changes anything on the target.
An LLM agent can't open a socket or finish a TLS handshake on its own. web-doctor does the live network work server-side and hands back a clean, graded verdict — so an agent (or a CI step) can audit a deployment in one call.
{
"mcpServers": {
"web-doctor": { "command": "npx", "args": ["-y", "web-doctor-mcp"] }
}
}Tools:
check_website_health — { "target": "example.com" }check_many — { "targets": ["example.com", "github.com"] }Or connect over HTTP at POST https://web-doctor.vercel.app/mcp.
GET https://web-doctor.vercel.app/check?target=example.com
GET https://web-doctor.vercel.app/check?target=https://github.com
GET https://web-doctor.vercel.app/check_many?targets=example.com,github.com,vercel.comRate-limited to 30 requests/hour/IP.
The /pro/* routes are gated by x402. Your agent pays $0.02 USDC per call automatically and gets the result. Settles on-chain (Base) to the operator wallet.
GET https://web-doctor.vercel.app/pro/check?target=<domain> # 402 → pay → result
GET https://web-doctor.vercel.app/pro/check_many?targets=... # up to 50 targets🟢 A — github.com (health score 96/100)
A — github.com is healthy: valid certificate, HTTPS enforced and the key security headers are in place.
TLS / certificate:
• Protocol: TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 handshake=84ms
• Certificate: valid & trusted issuer=CN=Sectigo ... expires in 220d
HTTP:
• Status 200 latency=140ms server=github.com
• HTTP→HTTPS redirect: yes
Security headers:
✅ Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
✅ Content-Security-Policy: default-src 'none'; ...
✅ X-Frame-Options: deny
✅ X-Content-Type-Options: nosniff
✅ Referrer-Policy: ...
✅ Permissions-Policy: ...npm install
npm run build
npm run test:engine # live smoke test
npm run dev:http # local server on :8080 (payments default ON; set X402_ENABLED=false to disable)
npm run dev:mcp # stdio MCP server| Var | Purpose |
|---|---|
X402_PAYTO | receiving wallet (default set) |
X402_NETWORK | base (default) |
X402_PRICE | $0.02 (default) |
X402_FACILITATOR_URL | mainnet facilitator that settles on the chosen network (required to actually collect on mainnet) |
X402_ENABLED | false to disable paid routes |
MIT
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.