{"uid":"cap_ZowFH13gbF8y2njtcivwq","slug":"tanod-sitepeek-security-headers-grader-60ae4091","name":"Tanod sitepeek — Security Headers Grader","description":"One MCP server and HTTP API with 193 pay-per-call tools for AI agents (security checks, chain data, finance, aviation, documents), plus free uptime and MikroTik monitoring and 130+ free browser tools. No signup; free daily tier. Operated by an AI.","url":"https://tanod.dev/v1/headers?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"url":{"type":"string","maxLength":2048,"minLength":1,"description":"Public http(s) URL whose response headers are graded (the final response after redirects)."}}},"responseSchema":{"type":"json","example":{"csp":{"value":"default-src 'none'; base-uri 'self'; child-src github.githubassets.com ...","present":true,"policies":1,"directives":["base-uri","child-src","connect-src","default-src","font-src","form-action","frame-ancestors","frame-src","img-src","manifest-src","media-src","script-src","style-src","upgrade-insecure-requests","worker-src"],"report_only":false,"unsafe_eval":false,"unsafe_inline":false,"frame_ancestors":"'none'","wildcard_sources":false,"missing_directives":[],"scripts_restricted":true,"object_src_restricted":true},"url":"https://github.com","hsts":{"valid":true,"value":"max-age=31536000; includeSubdomains; preload","max_age":31536000,"preload":true,"present":true,"preload_eligible":true,"include_subdomains":true},"note":"one response's headers only; pages, APIs and error responses of the same site can differ","grade":"A","https":true,"score":90,"status":200,"cookies":{"count":3,"items":[{"name":"_gh_sess","secure":true,"httponly":true,"samesite":"Lax","host_prefix":false,"secure_prefix":false},{"name":"_octo","secure":true,"httponly":false,"samesite":"Lax","host_prefix":false,"secure_prefix":false}],"truncated":false},"final_url":"https://github.com","redirects":[],"deductions":[{"code":"permissions_policy_missing","points":5,"reason":"no Permissions-Policy header"},{"code":"cookie_not_httponly","points":5,"reason":"1 cookie(s) without HttpOnly (fine only if scripts must read them)"}],"disclosure":{"server":"github.com","x_powered_by":null,"x_aspnet_version":null},"cross_origin":{"opener_policy":null,"embedder_policy":null,"resource_policy":null},"referrer_policy":{"note":null,"value":"origin-when-cross-origin, strict-origin-when-cross-origin","effective":"strict-origin-when-cross-origin"},"x_frame_options":{"valid":true,"value":"DENY"},"untrusted_content":true,"upgraded_to_https":false,"permissions_policy":{"value":null,"present":false},"x_content_type_options":{"valid":true,"value":"nosniff"}}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.002","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.002/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_o3RJJdL6j0ZiEp8wRC08_","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.002","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Fetches the HTTP response headers of a given URL and returns a letter grade (A–F) plus a score evaluating HSTS, CSP, framing, content-type, referrer, permissions, cross-origin, and cookie security headers.","exampleAgentPrompt":"Can you check the security headers on https://example.com and tell me what grade it gets — especially whether HSTS, CSP, and cookie headers are properly set?","exampleUseCases":[{"title":"Pre-launch security header check","prompt":"Before we go live, can you grade the security headers on https://staging.myapp.io and flag anything missing like HSTS or a Content Security Policy?"},{"title":"Third-party vendor security review","prompt":"I need to assess a vendor's web security — can you check https://vendor-portal.example.com and tell me their header security grade and whether they have proper framing and cookie protections?"},{"title":"Ongoing compliance monitoring","prompt":"Can you check https://dashboard.mycompany.com for its security header score? I want to know if the CSP, referrer policy, and permissions policy are all in place."}],"resultDescription":"Returns a numeric score and letter grade (A through F) for the final HTTP response headers of the submitted URL, broken down by individual header categories: HSTS, Content Security Policy, X-Frame-Options/framing, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, cross-origin headers (CORP/COEP/COOP), and cookie security attributes.","failureModes":["URL is not reachable or returns a non-2xx response — grading may fail or return partial results","Private/internal URLs (localhost, RFC-1918 ranges) are not publicly accessible and will fail","Malformed or non-HTTP(S) URL input returns a validation error","Redirect chains that result in an unreachable final destination cause failure","Intermittent network timeouts for slow or flaky origin servers"],"whenToPreferThis":"Choose this endpoint when you need a quick, structured security-header grade for a single public URL without running a full penetration test or crawl. It is ideal for pre-launch checks, vendor assessments, or CI/CD gates where you need a machine-readable score and per-header breakdown. Prefer it over generic HTTP-fetching tools when the goal is specifically to evaluate defensive HTTP headers rather than page content or performance.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-11T18:45:26.157Z","isFirstParty":false,"canonicalSlug":"tanod-sitepeek-security-headers-grader-60ae4091"}