Unchore Defend

What Unchore Defend does

The Unchore Defend MCP server provides two security-focused capabilities. Its site check grades HTTP security headers from A to F, reports the score, identifies missing protections, and gives a one-line remediation for each gap. It also produces a README badge showing the measured grade.

The defend tool is intended for defensive investigation. Give it a log, source file, configuration, suspicious message, or a question about an incident. It returns an assessment of what happened, how serious it may be, and what to address first. The tool is designed to explain attack activity without generating exploits or malware.

This places the project in the Security category for developers who need lightweight header checks or AI-assisted first-pass incident triage.

How it works

The site check sends one ordinary GET request to the target. It evaluates HTTPS, HSTS, Content-Security-Policy, clickjacking protection, nosniff, Referrer-Policy, Permissions-Policy, cookie flags, and whether the server version is exposed. The score weights these checks differently, with HTTPS carrying the largest weight. Redirects are checked again, while private, local, and cloud-metadata addresses are rejected. The request stops after three redirects, eight seconds, or 200 KB.

For defend, sensitive data is masked before transmission. The documented masking covers phone numbers, identification, card and account numbers, email addresses, API keys, tokens, and private keys. IP addresses, paths, and timestamps remain available because they can be important evidence.

When using OpenRouter, the default sequence asks Claude first, then GPT, GLM, and DeepSeek if the preceding model refuses. Requests ask OpenRouter to route only to providers marked as not collecting data. The chain can be changed with --chain, and --json produces machine-readable output.

Setup and configuration

Claude Code users can install the plugin from the Unchore marketplace. Claude Desktop users can download the .mcpb release package and open it. Other MCP clients can run the Node server with a configuration that points to mcp/server.mjs and supplies an API credential through the environment.

The Unchore Defend MCP server can also be used from a terminal. Node 22 or newer is required, and the repository provides commands for running the site check or piping a file and question into defend. The site check alone requires no key. Defend accepts either OPENROUTER_API_KEY, using the caller's OpenRouter account, or UNCHORE_TOKEN, created through Unchore account settings.

Tools and capabilities

• Grade nine categories of security headers on an A–F scale.
• Print specific fixes for missing or weak header protections.
• Generate a security-header badge for a README.
• Analyze logs, code, configurations, and suspicious text for defensive triage.
• Select an AI fallback order or force use of the caller's OpenRouter key.
• Return JSON output for automation.

Limitations and notes

A site-check grade measures response headers; it is not a complete security audit. The check also makes only the constrained request described above, so it does not assess application behavior beyond the returned headers.

Defend requires an OpenRouter key or Unchore token, and sending evidence to an AI provider has data-handling implications even with masking. The tool leaves IP addresses, paths, and timestamps intact. Provider responses can vary: the documented tests include refusals, false alarms, and timeouts, although the fallback chain can move to another model when a provider refuses.

The project describes defensive use only. It should be used to understand and stop suspected attacks, not to develop offensive code.