MCP.Market

SiteGuardian MCP server

online · 100% uptime
by gweber·io.github.gweber/siteguardian·v1.0.0
No reviews yet

EU-hosted website monitoring + 17-framework compliance MCP. One anonymous tool, four authenticated.

B79/100grade B
Write a reviewRun it
What users say
No reviews yet
Be the first
Safety scan
B79/100

full report

Adoption
New

0 stars

Reviews

Write one

Nobody has reviewed SiteGuardian yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

SiteGuardian tools (5, 1 write)

write = sends, deletes, buys or posts
  • get_domain_statusFree

    Returns the current security grade (A–F), last-scan timestamp, and list of active issues for a domain that is ALREADY under SiteGuardian monitoring by the authenticated account. Each issue carries a stable id, a severity, a short title, and an impact description. The response also includes a relative dashboard URL. Use this when the user asks about the current state of a specific monitored domain, wants to confirm a recent change landed, or needs issue ids to call get_fix_recommendations with a specific issue_id. Do NOT use this for domains not yet under monitoring — it will return a domain_not_monitored error; call scan_domain for one-off checks instead. Compliance framework tags (NIS2 / GDPR / DORA) are NOT included in v1; framework tagging on the monitored-domain path is tracked as a follow-up. Requires a valid API key.

  • get_drift_eventsFree

    Returns recent configuration drift events for a domain under monitoring by the authenticated account — TLS changes, DNSSEC state changes, new or removed security headers, shifts in third-party JS hosts, new cookies. Each event carries its observed-at timestamp, a kind (tls/dnssec/cookies/js_hosts/headers), a severity classified centrally (high for tls/dnssec/headers, medium for cookies/js_hosts, otherwise low), a short summary, and a sanitised detail payload. Use this when the user asks 'what changed' on a domain, wants to audit recent posture shifts, or is diagnosing an unexpected issue. Pair it with get_domain_status to see the current state and get_drift_events to see how it got there. Do NOT use this for a domain that is not under monitoring — you'll get a domain_not_monitored error; monitoring has to be active for the drift history to accumulate. Optional since (ISO-8601) and limit (1..100) params narrow the window. Requires a valid API key.

  • get_fix_recommendationsFree

    Returns copy-paste-ready fix recommendations (nginx, Apache, DNS, shell) for the issues found on a domain the caller has already paid for — either an active Monitor/Compliance subscription covering the domain, OR a purchased one-off Report for the domain. Each recommendation carries a stable issue_id, a priority (high/medium/low), a title, prose instructions, one or more config snippets with the target domain already interpolated, a verify command, and a category tag. Use this when the user asks how to fix an issue, wants the exact config to apply, or needs to verify a fix worked. Pass the optional issue_id to scope the response to one specific finding. The response is read-only — this tool NEVER triggers a fresh scan; fixes are computed from the most recent stored scan (including the Report-included re-scan if that was used). Do NOT use this for domains the caller hasn't purchased coverage for — you'll get an upgrade_required error that links to the pricing page. Do NOT use this to run or trigger a scan; call scan_domain for anonymous checks. Requires a valid API key.

  • list_monitored_domainsFree

    Returns the full list of domains under continuous SiteGuardian monitoring for the authenticated account. Each entry includes the domain, current security grade (A–F), timestamp of the last completed scan, and a relative dashboard URL. Use this when the user asks what they are monitoring, wants an inventory summary, or needs to look up a specific domain's exact spelling before calling get_domain_status / get_drift_events / get_fix_recommendations. The list is scoped entirely by the API key — there is no filter parameter to widen or narrow the result. Do NOT use this to enumerate domains the user does not own or monitor — it only returns their own inventory. Do NOT call it to trigger a scan (it does not); use scan_domain for one-off checks. Requires a valid API key.

  • scan_domainwrite actionFree

    Runs a free one-off security scan of the given domain and returns its grade (A–F), scan timestamp, and up to three top-priority issues with a permalink to the full report on siteguardian.io. Use this when the user asks for a quick security check of a domain that is NOT yet under SiteGuardian monitoring, or when they want a fresh assessment before subscribing. Results are cached for two hours, so repeated calls about the same domain return the same snapshot and mark it with cached=True. Do NOT use this for domains already under monitoring by the user — call get_domain_status instead for the account-scoped view with framework tags. Do NOT use this to batch-scan many domains as a competitive-intelligence tool; per-source-IP and per-target rate limits bound usage. This tool does not require authentication.

Public scan report

scanner v0.1.9 · 2026-09-27 · same rubric, same numbers if you re-run it

no findings
  • –Code scanremote-only server, no package to scann/a
  • Live reliabilityremote reachable in 1483ms20/20
  • Tool poisoning5 tool descriptions checked15/15
  • Auth qualityAPI key sent as a header8/15
  • Maintenancelast push 155 days ago8/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10
Overall 79/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How SiteGuardian compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
79/100
higher than 58% of 48,255 servers
Tools
5
the typical server has 7
Tools that change things
20%
typical: 0%. Fewer write tools means less an agent can break
Uptime
100%
of our recent checks; the typical remote server answers 100%
Response time
513 ms
faster than 29% of 30,031 servers

What its tools let an agent do: 4 read · 1 change

Install SiteGuardian in Claude Code, Cursor or VS Code

claude mcp add --transport http siteguardian https://mcp.siteguardian.io
Add to Cursor

What the publisher says

From the SiteGuardian repository's README, as published. We do not edit it. Read it on GitHub

SiteGuardian MCP — Examples & Client Configurations

Client configurations, copy-paste examples, and the MCP server manifest for the SiteGuardian Model Context Protocol server.

Note: This repository contains examples and client integration code only. The MCP server itself is hosted at https://mcp.siteguardian.io and is operated as a SaaS — server source is closed. Everything in this repo is MIT-licensed and free to fork.

What is the SiteGuardian MCP server?

A hosted MCP endpoint that lets Claude Desktop, Claude Code, Cursor, Windsurf, and VS Code Copilot query website-monitoring data and run security/compliance scans through natural-language tool calls.

  • Endpoint: https://mcp.siteguardian.io (or the canonical https://siteguardian.io/mcp)
  • Transport: Streamable HTTP
  • Hosting: Hetzner, Germany — EU data residency
  • Documentation: https://siteguardian.io/docs/mcp

Five tools

Try the anonymous tool (no setup required)

curl -X POST https://mcp.siteguardian.io/ \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"scan_domain","arguments":{"domain":"example.com"}}}'

Rate-limited to 10 calls/hour/IP. Cached for 2h per domain. Full curl/Python/JS examples in examples/.

Install in your client

All clients use the same endpoint. Copy-paste configs in clients/:

  • Claude Desktop — clients/claude-desktop.json
  • Claude Code (CLI) — clients/claude-code.sh
  • Cursor — clients/cursor.json
  • Windsurf — clients/windsurf.json
  • VS Code / Copilot — clients/vscode.sh

Authentication

The scandomain tool is anonymous**. The four monitoring tools require a Bearer key:

  1. Sign in at https://siteguardian.io
  2. Open Settings → API & Integrations
  3. Click Generate key, name it, copy it
  4. Add to your client config:
"headers": {"Authorization": "Bearer sg_live_..."}

API keys are available on the Monitor, Compliance, and Enterprise plans.

Privacy

  • EU-hosted. Hetzner Germany. No US sub-processor.
  • No LLM in the response path. Tool answers are deterministic from monitoring data.
  • No training on your queries. Logged for abuse prevention and billing only.
  • Audit trail. Every tool call is recorded in the SHA-256 hash chain.

Server manifest

The full machine-readable MCP server manifest is in server.json — this is the file consumed by the Anthropic MCP Registry and the various community directories.

Roadmap

  • [ ] OAuth 2.1 (per current MCP spec)
  • [ ] resources and prompts in addition to tools
  • [ ] Listing in the official Anthropic MCP Registry
  • [ ] Listing on Smithery and mcp.so

License

Examples and client configurations in this repository are released under the MIT License — see LICENSE.

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

SiteGuardian: common questions

Is SiteGuardian MCP server safe?
Mostly: it is graded B (79/100). Read the SiteGuardian safety report
How do I install SiteGuardian?
It runs remotely at mcp.siteguardian.io. Add it to Claude Code, Cursor, VS Code or Claude Desktop with the snippets above, or call it through the mcp.market gateway without installing anything.
Does SiteGuardian need an API key?
Yes. The registry entry asks for Authorization.
Is SiteGuardian maintained?
The last commit was 193 days ago (2026-04-25). The latest release is v1.0.0.
Is SiteGuardian up?
100% of our last 28 checks got an answer. We check remote servers about four times a day.
How does SiteGuardian compare with other MCP servers?
safety score 79/100 (higher than 58% of 48,255 servers); tools 5 (the typical server has 7); tools that change things 20% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.