{"uid":"cap_SUkNeJroUcBE6QWKmpbuO","slug":"cors-check-7d873556","name":"CORS Check","description":"CORS check for a URL: sends a request with an Origin (and a preflight OPTIONS) and reports Access-Control-Allow-Origin/Methods/Headers/Credentials, whether the origin is allowed, wildcard use, and the risky combination of wildcard with credentials. Integration and security testing. $0.01 per check.","url":"https://intel.rallylive.ca/site/cors","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","properties":{}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.01","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.01/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_54-jGgJBSKpjAIVy5gz_6","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.01","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Sends a real HTTP request and OPTIONS preflight to a URL and reports CORS policy headers, origin allowance, wildcard use, and credential risks.","exampleAgentPrompt":"Can you run a CORS check on https://api.example.com/data and tell me whether my origin is allowed, what methods are permitted, and if there's any risky wildcard-with-credentials combination?","exampleUseCases":[{"title":"Pre-deployment CORS validation","prompt":"Before I ship this frontend app, can you check if https://api.myservice.com/v1/users has CORS properly set up to allow requests from https://app.myservice.com, including what methods and headers are permitted?"},{"title":"Security audit for wildcard credentials risk","prompt":"I've heard that some APIs have a dangerous CORS misconfiguration where they use a wildcard origin together with credentials — can you check https://thirdparty-api.io/endpoint for that exact risk?"},{"title":"Debugging cross-origin request failures","prompt":"My browser is blocking requests to https://payments.partnersite.com/checkout from my app — can you do a CORS check and show me the Access-Control-Allow-Origin and Access-Control-Allow-Methods headers it returns?"}],"resultDescription":"Returns the CORS-related response headers (Access-Control-Allow-Origin, Access-Control-Allow-Methods, Access-Control-Allow-Headers, Access-Control-Allow-Credentials), a boolean indicating whether the origin is allowed, whether a wildcard is in use, and a flag for the dangerous wildcard-plus-credentials combination.","failureModes":["Target URL is unreachable or times out — no CORS data returned","Target URL returns no CORS headers — reported as CORS not configured","Invalid URL format — request rejected before sending","Target server blocks automated requests — may return 403 or no CORS headers","Preflight OPTIONS request rejected by server — partial results only"],"whenToPreferThis":"Use this endpoint when you need to programmatically verify CORS policy on any HTTP endpoint — especially during integration testing, pre-deployment checks, or security audits. It is purpose-built for CORS inspection with both a real GET and an OPTIONS preflight, and explicitly flags dangerous misconfigurations like wildcard origins combined with credentials, making it more useful than manually inspecting browser DevTools or generic HTTP inspection tools.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-14T13:13:23.618Z","isFirstParty":false}