AI Website Security

npx add-mcp 'https://scan.aiwebsitesecurity.com/api/mcp'

The connector

Ask your assistant whether your site is properly protected: it reads your home page like a visitor, using the AI Website Security tools, and replies with measured findings, each backed by its evidence.

Server address:

https://scan.aiwebsitesecurity.com/api/mcp

What your assistant checks, free of charge

• The HTTPS certificate: validity, expiry date, covered name, protocol.
• Redirection from http to https.
• Protection headers: HSTS, Content Security Policy, framing protection, nosniff, Referrer-Policy, cookies.
• Mixed content: resources still loaded over http on an https page.
• DNS filtering: if public security resolvers block your domain, some of your visitors cannot reach your site. This is a measured fact, never a verdict on your files.

Infection scanning, the integrity of your files, and what your pages do in a browser fall under the Record analysis, a paid service that your assistant will present to you with its pricing and the page where you can purchase it.

Adding it to your assistant

Claude

AI Website Security is listed in Claude's connector directory: open its page to add it in one click.

In claude.ai or Claude Desktop: Customize, then Connectors, then + Add and Add custom connector. Give it a name, paste the address above, then confirm. Claude's free plan supports one custom connector.

ChatGPT

On chatgpt.com/plugins: +, then Add custom MCP server, and paste the address above. According to OpenAI's help documentation as of 16 October 2026, this option is available on the Business, Enterprise and Edu plans, and on the Pro plan for read-only tools.

Le Chat

In Connectors: + Add Connector, Custom MCP Connector tab, then paste the address above and select open access.

Claude Code

claude mcp add --transport http ai-website-security https://scan.aiwebsitesecurity.com/api/mcp

Your data

• The server receives the address of the requested site, reads its public home page like a visitor, and returns the result to your assistant. The content of your conversation stays with your assistant.
• The domain is submitted to Cloudflare's and Quad9's public DNS resolvers for filtering comparison: this is the only information shared with a third party.
• The IP address of the call is used, for one hour and in memory only, to curb abuse. The host, Vercel, keeps its own technical request log according to its own retention period.
• The check result stays between you and your assistant: the server computes it, returns it to you, then forgets it.
• The server keeps an anonymous count of its calls: the date, the tool called and the assistant's name, and these alone. The requested site and your IP address remain outside this count.
• Purchases are made on this site, where you accept the terms of sale and confirm that you are the owner of the site. The rest of our practices is described on the Privacy page.
• For any questions: contact@aiwebsitesecurity.com