Mocking, security scanning, uptime monitoring and workflow automation are normally four separate products with four separate logins; the argument for this one is that they answer to the same conversation. The mocks, monitors and workflows are hosted state that persists after the chat ends, so the list tools matter — they are how you find what a previous session left running.
A hosted API-tooling server covering five areas at once: mocking, chaos injection, security and specification validation, network diagnostics, uptime monitoring, and workflow automation generated from specs or Postman collections. Everything runs against the vendor's service rather than on your machine.
- Mock endpoints created with custom response, headers and delay, then updated, listed and deleted
- Chaos rules created against an endpoint, listed and disabled
- A URL scanned for security issues across headers, TLS, CORS, CSP, HSTS and XSS, and its certificate checked for validity, expiry, issuer chain and protocols
- OpenAPI specifications validated, and JWTs decoded into header, payload and signature metadata
- Redirect chains analysed, CORS diagnosed against a given origin, distributed traces read from Jaeger, Zipkin or OpenTelemetry, and HAR files analysed for performance and errors
- Uptime monitors created with custom intervals and regions, and their status and uptime percentage read back
- Automation workflows created from steps, generated from an OpenAPI spec, imported from a Postman collection, then run and checked
- A webhook capture endpoint, and a resolve operation started
A client pointed at https://mcp.httpstatus.com/mcp over Streamable HTTP. Clients that support OAuth2 authorise in the browser; others send an API key from httpstatus.com as a Bearer token.
One command plus a key — npx -y mcp-remote https://mcp.httpstatus.com/mcp, then supply credentials