Discover and parse RFC 9116 security.txt (/.well-known/security.txt) including Contact and Expires.
- Free
- No signup
- Fast
- Privacy-friendly
What next?
Keep going with Security.txt Checker
Finish this check in the browser, then pick the path that matches how you work — another related tool, REST for apps, or MCP for agents.
- 1. Related check
After this result, run Security headers analyzer for the next signal.
Security headers analyzer - 2. Automate with API
Same job from your server with
Create free accountX-Api-Key. Free tier includes 500 credits/month. - 3. Hand off to an agent
Connect MCP and run playbook security-audit, then verify until pass.
security audit
What is Security.txt Checker?
Fetches /.well-known/security.txt and /security.txt, parses Contact/Expires and related fields. Helps verify vulnerability disclosure contact points. Agents include this in full-security-audit playbooks and verify after publishing updates — see <a href="/developers/security-audit">security audit</a>.
What are common questions about Security.txt Checker?
What does Security.txt Checker do?
Discover and parse RFC 9116 security.txt (/.well-known/security.txt) including Contact and Expires.
Is this available via API and MCP?
Yes. Same route under /api/v1/security-apis/{slug} with one ToolYour API key and shared credits.
What are the key features of Security.txt Checker?
Browser + API
Run in the browser or via REST/MCP.
Structured report
JSON-friendly output for agents and dashboards.
How do you use Security.txt Checker?
Open the tool
Use the Security Tools category page.
Provide input
URL, domain, or pasted text as required.
Review findings
Fix high-severity items first.
Free · API · MCPToolYour platform
Use Security.txt Checker three ways
The free Security.txt Checker on this page works in your browser. The same workflow is available via REST API for apps and via the remote MCP server for Cursor, Claude, and other agents — one API key, one plan, one quota. This tool is part of the security-apis module under Security Tools.
Agents close the full job with run_playbook security-audit, then verify until pass — see security audit.
- 1Create a free accountGet an API key for REST and MCP — 500 credits/month on the free tier.
- 2Connect or callPaste the MCP URL into Cursor/Claude, or call REST with
X-Api-Key. - 3Same key & creditsBrowser smoke-checks stay free; API-backed runs share one monthly credit quota.
- Free in browserUse Security.txt Checker here — no account required.
- REST APICall from your server with
X-Api-Key. - Remote MCP serverSame job from Cursor or Claude via the ToolYour remote MCP server — one API key with REST.
Which web-hardening tools sit in this cluster?
- Security headers analyzer
Live CSP, HSTS, XFO, and related headers.
- CSP policy evaluator
Author and sanity-check CSP text offline.
- Cookie security analyzer
Secure, HttpOnly, and SameSite flags.
- CORS policy checker
ACAO wildcards and Origin reflection.
- Subresource integrity checker
Missing integrity= on third-party assets.
Where does this job fit on ToolYour?
Where do you browse more security tools tools?
- Security Tools tools
Browse the full Security Tools category on ToolYour.
- Developer Tools tools
Format JSON, encode Base64/URL, mint UUIDs, convert timestamps, and test regex in the browser. REST and MCP sh
- Marketing Tools tools
Build UTM links, check ads copy limits, QA email subjects, and calculate ROAS/CPC/CTR — free in the browser; R
Which toolkits include Security.txt Checker?
- Security Toolkit
HTTP security headers, TLS, cookies, CORS, redirects, DNS, secrets, JWT, passwords, hashes, HMAC, bcrypt, security.txt, SRI, and email auth — plus agent playbooks for full audits and ship gates.
- Developer Toolkit
JSON/XML/SQL formatters, encoders, UUID/timestamp/regex, JSON codegen, JWT minting, HTTP headers, request builders, cron, minifiers, and color conversion — plus security and text peers.