HttpStatus MCP server
A remote MCP server that gives AI assistants the same HTTP diagnostics you get on this site. Nine read-only tools, OAuth-protected, hosted at the edge — nothing to install.
https://mcp.httpstatus.com/mcpConnect in one step
Cursor
Add to .cursor/mcp.json (project) or ~/.cursor/mcp.json (global), then approve the OAuth prompt.
{
"mcpServers": {
"httpstatus": {
"url": "https://mcp.httpstatus.com/mcp"
}
}
}Claude Code
One command; run /mcp inside Claude Code to complete sign-in.
claude mcp add --transport http httpstatus https://mcp.httpstatus.com/mcpClaude Desktop / Claude.ai
Settings → Connectors → Add custom connector, paste the endpoint URL and approve. If your Claude Desktop build only supports stdio servers, bridge it with mcp-remote:
{
"mcpServers": {
"httpstatus": {
"command": "npx",
"args": [
"-y",
"mcp-remote",
"https://mcp.httpstatus.com/mcp"
]
}
}
}Any other MCP client
Point it at the Streamable HTTP endpoint. Discovery metadata lives at:
https://mcp.httpstatus.com/.well-known/oauth-authorization-server
https://mcp.httpstatus.com/.well-known/oauth-protected-resource/mcpTools
| Tool | What it returns | On the site |
|---|---|---|
| check_url_status | Status code, status text, response time and headers for a URL (GET or HEAD). | open tool → |
| trace_redirects | Follow up to 15 redirect hops with per-hop status, latency and Location; detects loops. | open tool → |
| generate_status_url | A live URL that returns any status code 100–599, optionally delayed up to 10 s. | open tool → |
| generate_dummy_response | A live URL serving placeholder JSON (user, users, product, products, todo, error) plus a sample. | open tool → |
| check_ssl | Whether an HTTPS handshake to a hostname succeeds (trusted chain, matching name). | — |
| decode_jwt | Header and payload of a JWT with expiry status — decode only, no verification. | open tool → |
| scan_security_headers | Presence of HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy with an n/6 grade. | open tool → |
| check_cors | Simulated preflight and actual request from an origin; Access-Control-Allow-* headers and an allowed/blocked verdict. | open tool → |
| dns_lookup | A, AAAA, CNAME, MX, TXT or NS records via DNS-over-HTTPS. | open tool → |
Authorization and limits
The server implements the MCP authorization specification: OAuth 2.1 with PKCE, dynamic client registration and standard discovery documents. The first time a client connects it registers itself, opens a consent screen showing the client name, and receives a one-hour access token plus a refresh token. Tokens live in Cloudflare Workers KV; nothing else is stored.
Every tool is read-only and stateless. Outbound requests time out after 10 seconds, follow at most 15 redirects, and pass an SSRF guard that refuses private, loopback, link-local and cloud-metadata addresses — including hostnames that resolve to them. Usage is limited to 100 tool calls per hour per user.
Example prompts: “Why does my site redirect twice before landing on https?”, “Check whether api.example.com sets HSTS and CSP”, “Give me a URL that returns 503 after 3 seconds so I can test my retry logic”, “Is this JWT expired?”.
Frequently asked questions
Is the MCP server free?
Yes. It is rate-limited to 100 tool calls per hour per user to keep it free for everyone; there is no paid tier at the moment.
Why does it ask me to authorize?
The server follows the MCP authorization spec (OAuth 2.1 with PKCE and dynamic client registration). Your client registers itself, you approve it on a consent screen, and it receives a short-lived token. No account is created.
Can it reach internal or private URLs?
No. Every outbound request is checked against an SSRF guard that blocks localhost, private and link-local ranges, cloud metadata addresses and hostnames that resolve to them. Only public hosts can be inspected.
Does it store what I look up?
No. All tools are stateless; results are returned to your client and not persisted. The only stored data is the OAuth grant needed to keep your client connected.
Which transport does it use?
Streamable HTTP at the /mcp endpoint. Clients that only speak stdio can bridge with the mcp-remote package, as shown in the Claude Desktop snippet.