{"uid":"cap_N6sYjUSYQGhftpYzra15U","slug":"netintel-production-440c-up-railway-app-490353f8","name":"Security Headers Analyzer","description":"Fetches a URL and evaluates 10 security-critical response headers (CSP, HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, X-XSS-Protection, CORP, COEP, COOP), detects anti-patterns, and returns an overall security grade (A–F).","url":"https://netintel-production-440c.up.railway.app/security-headers/analyze?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["target"],"properties":{"target":{"type":"string","description":"URL or domain to audit security headers for (e.g. https://example.com)"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object","properties":{"meta":{"type":"object"},"grade":{"type":"string"},"score":{"type":"number"},"errors":{"type":"array"},"target":{"type":"string"},"results":{"type":"object"},"service":{"type":"string"},"warnings":{"type":"array"},"timestamp":{"type":"string"},"deductions":{"type":"array"}}}}}}},"responseSchema":{"type":"json","example":{"meta":{"duration_ms":312},"grade":"B","score":78,"errors":[],"target":"https://example.com","results":{"headers":{"referrer-policy":{"reason":"Referrer-Policy is set to strict-origin-when-cross-origin","status":"pass","present":true,"raw_value":"strict-origin-when-cross-origin"},"x-frame-options":{"reason":"X-Frame-Options is set to DENY","status":"pass","present":true,"raw_value":"DENY"},"x-xss-protection":{"reason":"X-XSS-Protection not set — modern browsers use CSP instead","status":"info","present":false,"raw_value":null},"permissions-policy":{"reason":"Permissions-Policy not set — browser features not restricted","status":"warn","present":false,"raw_value":null},"x-content-type-options":{"reason":"X-Content-Type-Options is set to nosniff","status":"pass","present":true,"raw_value":"nosniff"},"content-security-policy":{"reason":"Content-Security-Policy is set with a strong policy","status":"pass","present":true,"raw_value":"default-src 'self'"},"strict-transport-security":{"reason":"HSTS enabled with max-age=31536000","status":"pass","present":true,"raw_value":"max-age=31536000; includeSubDomains"},"cross-origin-opener-policy":{"reason":"Cross-Origin-Opener-Policy not set","status":"info","present":false,"raw_value":null},"cross-origin-embedder-policy":{"reason":"Cross-Origin-Embedder-Policy not set","status":"info","present":false,"raw_value":null},"cross-origin-resource-policy":{"reason":"Cross-Origin-Resource-Policy not set","status":"info","present":false,"raw_value":null}},"summary":{"fail":0,"info":4,"pass":6,"warn":0},"final_url":"https://example.com/","status_code":200,"content_type":"text/html; charset=utf-8","anti_patterns":[{"header":"x-powered-by","reason":"Information leakage — reveals server framework","severity":"warn","raw_value":"Express"}]},"service":"security-headers","warnings":[],"timestamp":"2025-01-15T12:00:00.000Z","deductions":[{"points":-5,"reason":"Permissions-Policy not set"},{"points":-2,"reason":"Cross-Origin-Resource-Policy not set"},{"points":-2,"reason":"Cross-Origin-Embedder-Policy not set"},{"points":-2,"reason":"Cross-Origin-Opener-Policy not set"},{"points":-3,"reason":"X-Powered-By header exposes server framework"}]}},"example":{"request":{"input":{"type":"http","method":"GET","queryParams":{"target":"https://www.google.com"}}},"response":{"meta":{"duration_ms":82},"grade":"F","score":24,"errors":[],"target":"https://www.google.com","results":{"headers":{"referrer-policy":{"reason":"Referrer-Policy not set — browser uses default which may leak URLs","status":"fail","present":false,"raw_value":null},"x-frame-options":{"reason":"X-Frame-Options is set to SAMEORIGIN","status":"pass","present":true,"raw_value":"SAMEORIGIN"},"x-xss-protection":{"reason":"X-XSS-Protection explicitly disabled — correct for modern browsers with CSP","status":"pass","present":true,"raw_value":"0"},"permissions-policy":{"reason":"Permissions-Policy not set — browser features not restricted","status":"warn","present":false,"raw_value":null},"x-content-type-options":{"reason":"X-Content-Type-Options not set — vulnerable to MIME-type sniffing","status":"fail","present":false,"raw_value":null},"content-security-policy":{"reason":"Content-Security-Policy not set — no XSS or injection protections","status":"fail","present":false,"raw_value":null},"strict-transport-security":{"reason":"Strict-Transport-Security not set — no HTTPS enforcement","status":"fail","present":false,"raw_value":null},"cross-origin-opener-policy":{"reason":"Cross-Origin-Opener-Policy not set","status":"info","present":false,"raw_value":null},"cross-origin-embedder-policy":{"reason":"Cross-Origin-Embedder-Policy not set","status":"info","present":false,"raw_value":null},"cross-origin-resource-policy":{"reason":"Cross-Origin-Resource-Policy not set","status":"info","present":false,"raw_value":null}},"summary":{"fail":4,"info":3,"pass":2,"warn":1},"final_url":"https://www.google.com/","status_code":200,"content_type":"text/html; charset=ISO-8859-1","anti_patterns":[{"header":"server","reason":"Server header present without version","severity":"info","raw_value":"gws"}]},"service":"security-headers","warnings":[],"timestamp":"2026-06-13T04:19:22.428Z","deductions":[{"points":-25,"reason":"Content-Security-Policy not set"},{"points":-20,"reason":"Strict-Transport-Security not set"},{"points":-10,"reason":"X-Content-Type-Options not set"},{"points":-10,"reason":"Referrer-Policy not set"},{"points":-5,"reason":"Permissions-Policy not set"},{"points":-2,"reason":"Cross-Origin-Resource-Policy not set"},{"points":-2,"reason":"Cross-Origin-Embedder-Policy not set"},{"points":-2,"reason":"Cross-Origin-Opener-Policy not set"}]}},"exampleRequest":{"target":"https://www.google.com"},"tags":["x402"],"displayCostAmount":"0.01","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"settled","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.01/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_lYrvk3Rf-ZGA5COoBxVKa","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.01","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Fetches a URL and grades its HTTP security response headers (CSP, HSTS, X-Frame-Options, etc.) with an A–F overall score and detected anti-patterns.","exampleAgentPrompt":"Can you audit the HTTP security headers for https://mycompany.com and tell me what grade it gets, which critical headers are missing, and any anti-patterns detected?","exampleUseCases":null,"resultDescription":"Returns a JSON object with the target URL, an overall letter grade (A–F), a numeric score, per-header pass/fail results for all 10 security headers (CSP, HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, X-XSS-Protection, CORP, COEP, COOP), arrays of warnings, errors, and score deductions, plus a timestamp and service metadata.","failureModes":["Target URL unreachable or times out — returns error in errors array","Invalid or malformed URL provided — schema validation failure","Target returns non-HTTP response — parsing error","Rate limiting or network errors from the target host","Missing required 'target' query parameter — request rejected"],"whenToPreferThis":"Use this endpoint when you need a structured, graded audit of a website's HTTP security response headers — especially when you need to check all 10 major security headers at once, detect anti-patterns, and receive an overall A–F grade. Prefer this over manual header inspection or generic HTTP probing tools when you want actionable security feedback for a web application or domain.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-11T06:32:38.724Z","isFirstParty":false,"canonicalSlug":"netintel-production-440c-up-railway-app-490353f8"}