{"uid":"cap_-0qE4kW9ZVX9BjLfHgWke","slug":"agent402-tools-http-security-headers-analyzer-ed0aefa7","name":"agent402.tools HTTP Security Headers Analyzer","description":"Fetch a URL and return every response header plus a security analysis: HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP/CORP/COEP. Scores 0–100 by presence, flags weak HSTS, and warns on Server/X-Powered-By identity leaks. SSRF-protected.","url":"https://agent402.tools/api/http-headers","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"url":{"type":"string","description":"Public http(s) URL to probe"},"method":{"type":"string","description":"GET or HEAD (default GET)"}}},"responseSchema":{"type":"json","example":{"url":"https://example.com/","status":200,"headers":{"server":"ECAcc (nyd/D17C)","content-type":"text/html; charset=UTF-8"},"finalUrl":"https://example.com/","security":{"score":0,"findings":[{"value":null,"header":"HSTS","present":false}],"warnings":["Server header leaks identity: ECAcc (nyd/D17C)"]},"fetchedAt":"2026-06-19T22:00:00.000Z","redirected":false,"statusText":"OK","httpVersion":null}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.003","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.003/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.003","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.003","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_dv-qDO-Df7-4mdtfAGdwh","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.003","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Fetches HTTP response headers from a URL and performs a scored security analysis covering HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and COOP/CORP/COEP.","exampleAgentPrompt":"Can you fetch the HTTP headers from https://example.com and give me a security score with analysis of their HSTS, CSP, X-Frame-Options, and any other security headers — I want to know what's missing or weak?","exampleUseCases":null,"resultDescription":"Returns all HTTP response headers from the target URL plus a 0–100 security score based on the presence and quality of headers like HSTS (with weak-configuration flags), CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP, CORP, and COEP, along with warnings for information-leaking headers like Server or X-Powered-By.","failureModes":["URL is unreachable or times out — error returned with no headers or score","Non-public or localhost URL provided — rejected or no response","Invalid URL format — validation error before any request is made","HTTP redirect loops or TLS errors — connection failure reported"],"whenToPreferThis":"Choose this endpoint when you need a structured security header audit with a numeric score and per-header analysis rather than just raw header values. Ideal for automated security checks, CI/CD pipelines, or compliance reviews where you need to know not just what headers are present but whether they are correctly configured (e.g., weak HSTS max-age, missing CSP directives).","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-16T12:02:30.769Z","isFirstParty":false}