Guardr MCP 快速入門

Guardr is website health monitoring for freelancers and small agencies who manage client sites. It checks a site from the outside and keeps watch on it. There is nothing to install on the site and no access to your server.

Guardr also answers the Model Context Protocol. An agent such as Claude Code or Cursor connects once with your API key. It then calls Guardr as tools instead of raw HTTP requests. This post is the short version of the setup.

What the endpoint is

The endpoint is one address: https://api.guardr.io/mcp.

• Transport is streamable HTTP. It takes POST requests only. A GET or a DELETE answers 405.
• Auth is the X-API-Key header. It is the same key the Guardr REST API takes. Nothing else is needed.
• Every tool runs as the holder of that key. An agent reads exactly what the REST API returns for the same account.

Three tools are live. There are no others.

No tool changes anything on your site. In our words: "Guardr proposes, it does not apply."

Step 1: get an API key

Sign up at guardr.io. The Free plan covers one site with no credit card. It includes the REST API and the MCP endpoint.

In the dashboard open API Access and create a key. A label is optional. The key is shown once so copy it right away. Each plan comes with 2 keys and a revoked key stops working at once.

Treat the key the way you treat a password. Anything holding it can read your account.

Step 2: add the server to your client

We document two clients today: Claude Code and Cursor.

Claude Code

One command registers the endpoint. Run it in any project:

claude mcp add --transport http guardr https://api.guardr.io/mcp --header "X-API-Key: your-key-here"

Cursor

Cursor reads ~/.cursor/mcp.json on macOS and Linux. On Windows it reads %USERPROFILE%/.cursor/mcp.json. Add this block:

{"mcpServers":{"guardr":{"url":"https://api.guardr.io/mcp","headers":{"X-API-Key":"your-key-here"}}}}

Then open the MCP settings panel and refresh the server list.

In both cases replace your-key-here with the key from Step 1.

We have not written setup steps for other clients yet. If your client installs servers from a registry you can find Guardr in the three listings below.

Step 3: run one check

Ask your agent to check a public domain with Guardr. For example:

Run check_site on example.com

Any public domain may be checked. That is the same rule POST /v1/scan follows. The result for a domain another account watches is the result anybody checking that domain would get.

check_site returns the same fields as POST /v1/scan:

• the letter grade from A to F
• the score from 0 to 100
• the five category scores: TLS / SSL, Security Headers, Exposure paths, Cookies and DNS
• the findings with their severity (critical, high, medium or low)
• any API keys or tokens the check read out of JavaScript bundles

The values match the REST route field for field. Only the whitespace differs. The REST API prints its JSON indented while a tool result is compact. If you compare the two then compare the parsed values and not the bytes.

The other two tools

list_sites returns the sites your account watches with the same fields as GET /v1/sites. That covers grade, uptime percentage, response times and data_confidence for each site. A key bound to a single site returns that one site.

get_site takes one domain your account watches. No REST route answers this one. Its body is built from the list_sites row for that domain, the monitoring summary of its latest check and its uptime summary.

A domain your account does not watch answers exactly the way an unknown domain answers. So the tool cannot be used to learn which domains other accounts watch.

Limits

Every POST to the endpoint counts against the same burst allowance as a REST call. Listing the tools counts too. The REST API allows 60 requests per minute per key.

Every tool result carries the allowance it was served under in _meta.rate_limit: limit, remaining, reset and retry_after. The one exception is the call that lists the tools. It spends the allowance without reporting it.

When the allowance is spent the endpoint answers 429 with a JSON-RPC error whose message is rate_limited. A missing key or an unknown key answers exactly as the REST API answers it.

Where it is listed

• Smithery
• Official MCP Registry as io.guardr/guardr
• Glama

The full reference is on the MCP docs page. The story behind the endpoint is on the Guardr for agents page.

That is the whole setup: one key, one endpoint and three tools.