@pipeworx/mozilla-observatory

Connect: https://gateway.pipeworx.io/mozilla-observatory/mcp · Install: one-click buttons

No MCP client? Skip the connection: POST https://gateway.pipeworx.io/v1/tools/search_packs {"query":"..."} to find a tool below, GET /v1/tools/<name> for its schema, POST the same URL with arguments for the data — see For AI agents.

Tools: 3

MDN HTTP Observatory — grade any website’s HTTP security headers and get the specific fixes, from Mozilla’s public scanner.

Tools

• observatory_scan(host) — runs (or returns Mozilla’s recent) scan and gives the letter grade A+..F, the numeric score, and the pass/fail counts.
• observatory_results(host, only_failures?, include_history?, history_limit?) — all 12 tests with pass/fail, score impact, Mozilla’s own remediation prose, the observed response headers, and the host’s grade history.
• observatory_grade_distribution() — how many scanned sites hold each grade, so a single grade can be placed against the web at large.

Auth

Keyless.

Data sources

• POST https://observatory-api.mdn.mozilla.net/api/v2/scan?host= — scan summary.
• GET https://observatory-api.mdn.mozilla.net/api/v2/analyze?host= — full detail.
• GET https://observatory-api.mdn.mozilla.net/api/v2/grade_distribution — histogram.

Things the next person would otherwise rediscover

• The detail endpoint is /analyze, not /scan. GET /api/v2/scan?host= is a 404 — /scan exists only as a POST. /api/v2/tests?scan=<id> and /api/v2/scan/<id> are both 404 as well (all verified 2026-09-17). The histogram is grade_distribution with an underscore; the hyphenated spelling 404s.
• tests_failed and pass: false disagree, and both are right. Mozilla counts only score-reducing failures in tests_failed, but sets pass: false on informational tests with a score_modifier of 0 too — mozilla.org on 2026-09-17 reported tests_failed: 2 with four tests marked not-passing. The pack returns a per-test penalized flag and a tests_failing_with_score_impact count rather than dropping the zero-impact rows, so only_failures returning more rows than tests_failed is expected and explained in the payload.
• recommendation and score_description are HTML fragments. Stripped to prose before returning.
• A host that does not resolve comes back as a 200 with a populated error field rather than an HTTP error; the pack raises on it.

Tools

• observatory_scan — Scan a website’s HTTP security headers with the MDN HTTP Observatory and return its letter grade (A+ to F), numeric score, and how many of Mozilla’s 12 tests it passed. AUTHORITATIVE for “how secure a
• observatory_results — Get the full MDN HTTP Observatory breakdown for a host: every one of the 12 security tests with pass/fail, the score impact, Mozilla’s specific remediation advice (CSP, HSTS, cookies, CORS, referrer p
• observatory_grade_distribution — Grade distribution across every site the MDN HTTP Observatory has scanned — how many sites hold each grade from A+ to F. Use it to say where one site’s grade sits relative to the web (e.g. “a B beats