What the Assistant Can See

HeaderHawk’s MCP server gives an AI assistant 11 tools. Every one reads; none changes anything. The assistant decides which to call from each tool’s own description, so you ask in your own words (“what broke on checkout this week?”) rather than naming a tool.

The tools are on the Professional, Business and Enterprise plans. Each reads what a member with the viewer role can read in the dashboard, for the one account the member signed in to, whatever their own role is.

The tools

Tool	Title	What it answers	Reads reports
whoami	Who am I connected as	Which account the assistant is connected to, its plan and how long it keeps reports, and the sites it monitors.	No
list_issues	List issues	What broke: the issues found in your reports, grouped as the dashboard’s Issues page groups them, with how many reports each has and when it was first and last seen.	Yes
get_issue	Explain one issue	One issue in detail: what was blocked and by which directive, the pages and browsers it came from (and an integrity issue’s files), sample reports and what would fix it.	Yes
search_reports	Search and count reports	How many reports match a question, grouped by directive, host, page or browser, with each group’s trend against the period before.	Yes
list_scripts	List a site’s scripts	A site’s script inventory: each script’s review status, the library and version it was identified as, whether advisories name that version, and the payment pages it ran on.	Yes
get_script	Explain one script	One script in detail: its advisories and fixed versions, the hashes it was seen with, and who authorized or rejected it and why.	Yes
get_page_scan	Latest scan of a monitored page	The latest daily scan of a monitored page: its grade, the security headers it sent and is missing, the scripts a payment page loads, and what changed since the scan before.	No
get_csp_policy	The CSP policies a site enforces	The Content Security Policies browsers quoted in a site’s reports, which is what they enforced, with when each was first and last seen.	Yes
get_policy_proposal	The CSP proposed from a site’s traffic	The Content Security Policy proposed from a site’s policy discovery run, with who each source belongs to, the evidence for it, and why any looks wrong.	Yes
pci_dss_status	PCI DSS 6.4.3 and 11.6.1 readiness	Whether a site meets PCI DSS requirements 6.4.3 and 11.6.1 as the Compliance page states it, with the gaps and the evidence behind each.	Yes
reliability_summary	Network errors, crashes and deprecations	Failed requests by type and origin, page crashes, and the deprecated APIs your pages still use with when browsers plan to remove them.	Yes

A tool marked Reads reports counts against your account’s budget of report reads, 60 a minute unless your contract raises it, which it shares with your API keys. Over it, the assistant is told how many seconds to wait.

What a tool leaves out

• Anything that changes your account. No tool creates, edits or deletes a site, an alert rule, a script decision or a key.
• Raw report bodies. The tools answer from the counts and samples the dashboard shows, not from the stored copy of each report.
• Settings. Members, API keys, billing and single sign-on are not readable through any tool.

What a report says comes from the browsers that visited your pages, so an assistant is told to treat every string a tool returns from a report as data and never as an instruction. See Security.