com.dontdeployonfriday/golive-check

Est-ce que com.dontdeployonfriday/golive-check est sûr ?

Au dernier audit MCP Hub, le serveur MCP « com.dontdeployonfriday/golive-check » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 4 outils

• analyze_headers≈ 2670 tokens

  Check raw HTTP response headers from a deployment you already operate. Returns the same object as POST /v1/analyze. Unknown fields are ignored. A url field is not fetched. Nothing is stored. Nothing is for sale.

  Paramètres, retour & exemple (4)

  Paramètres

  • platform · string · optionnel
    Platform whose config the caller can edit. A fix snippet is attached only for caddy, nginx, vercel, netlify, or nextjs. Any other declared platform, or an omitted platform, returns fix null. This server does not guess the platform from the Server header.
  • config_text · string · optionnel
    Optional config text. Not copied into the response. When platform is caddy and this is non-empty, GLC-HSTS-MISSING includes config_header present or absent for one Caddy Strict-Transport-Security form with max-age greater than 0, GLC-CSP-MISSING includes config_header present or absent for one Caddy Content-Security-Policy form with a non-empty quoted value, GLC-NOSNIFF-MISSING includes config_header present or absent for one Caddy X-Content-Type-Options form set to nosniff, GLC-FRAME-MISSING includes config_header present or absent for one Caddy X-Frame-Options form set to DENY or SAMEORIGIN, GLC-REFERRER-MISSING includes config_header present or absent for one Caddy Referrer-Policy form with a non-empty value, and GLC-SERVER-VERSION-LEAK includes config_header present or absent only when that text deletes both Server and X-Powered-By. One deletion is absent. GLC-CORS-WILDCARD-CREDENTIALS includes config_header present or absent for one Caddy > replace of Access-Control-Allow-Origin whose replacement is non-empty and is not *. A line that sets that header without >, and a deletion, are absent. A Content-Security-Policy frame-ancestors line does not count as X-Frame-Options. When platform is nginx and this is non-empty, GLC-HSTS-MISSING includes config_header present or absent for one nginx add_header Strict-Transport-Security line with max-age greater than 0, GLC-CSP-MISSING includes config_header present or absent for one nginx add_header Content-Security-Policy line whose quoted value is non-empty after trim, and GLC-NOSNIFF-MISSING includes config_header present or absent for one nginx add_header X-Content-Type-Options line whose quoted value is nosniff. Any other value is absent. GLC-FRAME-MISSING includes config_header present or absent for one nginx add_header X-Frame-Options line whose quoted value is DENY or SAMEORIGIN. Any other value is absent. Content-Security-Policy-Report-Only does not count. A Content-Security-Policy frame-ancestors line does not count as X-Frame-Options. An empty quoted value, or a quoted value that is only spaces, is absent. A value that contains {, }, or $ is absent. GLC-REFERRER-MISSING includes config_header present or absent for one nginx add_header Referrer-Policy line whose quoted value is non-empty after trim. After trim, the accepted lines are add_header Referrer-Policy "<value>" always; and add_header Referrer-Policy "<value>";. The semicolon is required. An empty quoted value, or a quoted value that is only spaces, is absent. A value that contains {, }, or $ is absent. When platform is nginx, the version-leak field is present only for both lines server_tokens off; and proxy_hide_header X-Powered-By;. One of those lines is absent. The CORS field is present for one add_header Access-Control-Allow-Origin line whose quoted value is non-empty after trim and is not *. When platform is vercel, JSON headers entries are scanned for HSTS, CSP, nosniff, frame, referrer, and Access-Control-Allow-Origin using those same value rules, and the version-leak field is absent because vercel.json cannot delete Server or X-Powered-By. When platform is netlify, an indented Header: value line is scanned the same way, and the version-leak field is absent. When platform is nextjs, a headers() key and value pair is scanned the same way, and the version-leak field is present only when poweredByHeader is false. A value that contains {, }, or $ is absent. The Caddy scans still run only when platform is caddy. Other config text is not checked. Do not include secret values.
  • headers_raw · string · requis
    Raw HTTP response headers from a deployment this agent already operates, including an optional status line, as curl -sI prints them. This server does not request a URL.
  • paths_tested · array · optionnel
    Optional paths. Accepted and not checked. This server does not request them.

  Exemple d'appel

  {"name": "analyze_headers", "arguments": {"headers_raw": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"notes": [], "schema": "texte", "checked": [], "findings": [], "platform": "texte", "config_text": "absent", "paths_tested_count": 1, "parsed_header_count": 1}}

• explain_finding≈ 404 tokens

  Explain one finding id from the seven. Returns id, severity, why, and answer_page. answer_page is the CSP and clickjacking page for GLC-CSP-MISSING and GLC-FRAME-MISSING, and null for the other five. Unknown fields are ignored. A url field is not fetched. Nothing is stored. Nothing is for sale.

  Paramètres, retour & exemple (1)

  Paramètres

  • id · string · requis · GLC-HSTS-MISSING | GLC-CSP-MISSING | GLC-NOSNIFF-MISSING | GLC-FRAME-MISSING | GLC-REFERRER-MISSING | GLC-SERVER-VERSION-LEAK | GLC-CORS-WILDCARD-CREDENTIALS
    One finding id from the seven. Unknown fields are ignored. A url field is not fetched.

  Exemple d'appel

  {"name": "explain_finding", "arguments": {"id": "GLC-HSTS-MISSING"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"id": "GLC-HSTS-MISSING", "why": "texte", "severity": "high", "answer_page": "texte"}}

• get_fix≈ 505 tokens

  Return the registry snippet for one finding id and one platform. The platforms are caddy, nginx, vercel, netlify, nextjs. The result is id and fix. fix has platform, snippet, source_url, and last_verified, and note when the registry file has one. An omitted or unknown platform returns fix null. Unknown fields are ignored. A url field is not fetched. source_url is not fetched. Nothing is stored. Nothing is for sale.

  Paramètres, retour & exemple (2)

  Paramètres

  • id · string · requis · GLC-HSTS-MISSING | GLC-CSP-MISSING | GLC-NOSNIFF-MISSING | GLC-FRAME-MISSING | GLC-REFERRER-MISSING | GLC-SERVER-VERSION-LEAK | GLC-CORS-WILDCARD-CREDENTIALS
    One finding id from the seven. Unknown fields are ignored. A url field is not fetched.
  • platform · string · optionnel
    Platform whose config the caller can edit. caddy, nginx, vercel, netlify, nextjs returns that registry snippet. Any other value, or an omitted platform, returns fix null. This server does not guess the platform from the Server header. source_url is a citation and is not fetched.

  Exemple d'appel

  {"name": "get_fix", "arguments": {"id": "GLC-HSTS-MISSING"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"id": "GLC-HSTS-MISSING", "fix": "texte"}}

• report_feedback≈ 409 tokens

  Report one finding id and one outcome. The outcomes are false_positive, fix_worked, fix_failed. The result is id, outcome, and stored false. Nothing is written: no file, no counter, and no log line. A note, a url, and headers are ignored. A url field is not fetched. This server does not guess the platform from the Server header. Nothing is for sale.

  Paramètres, retour & exemple (2)

  Paramètres

  • id · string · requis · GLC-HSTS-MISSING | GLC-CSP-MISSING | GLC-NOSNIFF-MISSING | GLC-FRAME-MISSING | GLC-REFERRER-MISSING | GLC-SERVER-VERSION-LEAK | GLC-CORS-WILDCARD-CREDENTIALS
    One finding id from the seven. A note, a url, and headers are ignored. A url field is not fetched.
  • outcome · string · requis · false_positive | fix_worked | fix_failed
    Exactly one of false_positive, fix_worked, fix_failed. Any other value is unknown_outcome. Nothing is written.

  Exemple d'appel

  {"name": "report_feedback", "arguments": {"id": "GLC-HSTS-MISSING", "outcome": "false_positive"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"id": "GLC-HSTS-MISSING", "stored": "texte", "outcome": "false_positive"}}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://dontdeployonfriday.com/mcp