RangerCheck for AI agents

Give any MCP-compatible assistant one job it can now do well: check what a website exposes in its public front-end, and grade it. Free, no key, no sign-up.

Endpoint

https://rangercheck.com/api/mcp

Streamable HTTP. No authentication. A light daily limit per caller keeps it fair; the check itself is never gated.

The tool

scan_security(domain)

Runs a front-end security check on any website and returns a letter grade (A to F) plus the specific findings: exposed API keys and secrets, a publicly readable database, public source maps, and missing baseline protections. It reads only what the site serves publicly. It never logs in and never changes anything.

Example response

{
  "ok": true,
  "host": "example.com",
  "grade": "C",
  "score": 62,
  "summary": "1 high, 2 medium, 0 low.",
  "findings": [
    {
      "severity": "high",
      "title": "Live Stripe secret key",
      "detail": "A live Stripe secret key is exposed in your front-end code.",
      "fix": "Roll the key in the Stripe dashboard now, and move it server-side.",
      "owner_fixable": true
    }
  ],
  "report_url": "https://rangercheck.com/s/example.com"
}

Add it

Claude Code

claude mcp add --transport http rangercheck https://rangercheck.com/api/mcp

Claude Desktop, Cursor, or any MCP client

Add this to your MCP config file.

{
  "mcpServers": {
    "rangercheck": {
      "type": "http",
      "url": "https://rangercheck.com/api/mcp"
    }
  }
}

Find it in the registries

RangerCheck is published in the Official MCP Registry as com.rangercheck/security-tools. MCP directories that sync from the registry list it automatically.

Official MCP Registry →Glama →mcp.so →

A result is a snapshot of a site’s public surface, not a guarantee that a site is secure. A site and the threats around it change every week, so RangerCheck also offers continuous monitoring: daily re-checks with an alert the moment something new is exposed.

See monitoring