Audit app security and email authentication
The user gets a detailed security audit of their web application, including missing browser headers, exposed files, and DNS records for email authentication, ensuring the app is safe to launch and emails reach the inbox.
How it works
The agent performs a baseline security check using check_app_security to identify missing public headers like CSP or X-Frame-Options. If the user provides ownership verification, it runs deep_scan_app to look for exposed .env or .git files. It also uses check_email_authentication to verify SPF, DKIM, and DMARC records against Gmail, Yahoo, and Outlook standards. The agent summarizes findings to help the user fix security gaps before launch.
Prompt
Paste this into an agent that has the servers below connected. Adjust the names and dates to your own.
Check if myapp.lovable.app is missing basic security protections and verify if mystore.com has correct SPF, DKIM, and DMARC records to prevent emails from landing in spam.MCP servers it needs
Source
The vendor page this playbook is drawn from, and the passage that supports it.
check_app_security Is an app safe to launch The baseline browser protections a web app is missing, from the public headers any visitor already receives.7IT Tools for ChatGPT, Claude and Cursor (MCP) | 7IT