{"uid":"cap_esyQ2xina6nSuA8TRRcyT","slug":"mekler-ai-security-header-cors-policy-checker-13d888e7","name":"Mekler AI Security Header & CORS Policy Checker","description":"Inspect one public URL for observed security headers and cross-origin configuration. Send passive GET and credential-free OPTIONS with a supplied origin, requested method and optional header names; return exact selected headers and evidence-linked findings. No authorization/cookies, exploit attempts, state-changing requests, browser enforcement guarantee or full CSP/TLS analysis.","url":"https://api.mekler.ai/v1/web/headers/check-security-policy?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"url":{"type":"string","maxLength":2048},"origin":{"type":"string","default":"https://mekler.ai","maxLength":2048},"request_id":{"type":"string","pattern":"^[A-Za-z0-9_-]{16,64}$"},"request_headers":{"type":"array","items":{"type":"string","pattern":"^[a-z0-9-]{1,64}$"},"default":[],"maxItems":20},"requested_method":{"enum":["GET","HEAD","POST","PUT","PATCH","DELETE"],"type":"string","default":"GET"}}},"responseSchema":{"type":"json","example":{"url":"https://mekler.ai/","origin":"https://mekler.ai","status":"ok","findings":[{"code":"hsts_absent","evidence":"No HSTS response header.","severity":"info","recommendation":"Consider HSTS after confirming HTTPS coverage for the intended host scope."},{"code":"csp_absent","evidence":"No enforced CSP response header.","severity":"info","recommendation":"Consider a tested CSP appropriate to the application; report-only is not enforcement."}],"preflight":{"url":"https://mekler.ai/","headers":{"x-content-type-options":"nosniff","access-control-allow-origin":"*","access-control-allow-methods":"GET, HEAD"},"http_status":200},"http_status":200,"limitations":["Passive GET and credential-free OPTIONS observations only; no cookies, authorization, exploit attempts or state-changing method is sent.","Observed policies may vary by route, origin, browser and authentication. This is not a vulnerability scan or a browser enforcement/safety certification.","CSP syntax/effective-policy analysis and TLS certificate inspection are outside this operation."],"observed_at":"2026-10-20T00:00:00Z","request_headers":[],"requested_method":"GET","response_headers":{"x-content-type-options":"nosniff","access-control-allow-origin":"*","access-control-allow-methods":"GET, HEAD"}}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.005","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.005/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.005","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.005","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_i1dMsCHEZtBSjW4t8wy8l","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.005","costPer":"request","priority":0,"asset":"EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Passively inspects a public URL's HTTP security headers and cross-origin (CORS) configuration by issuing a GET and a credential-free OPTIONS preflight, returning observed headers and severity-tagged findings.","exampleAgentPrompt":"Can you check the security headers and CORS policy on https://example.com for me? Use https://myapp.com as the origin and check if it allows POST requests.","exampleUseCases":[{"title":"Pre-deployment security header audit","prompt":"Before I launch my site at https://mystore.com, can you check what security headers it's sending and flag anything important that's missing, like HSTS or CSP?"},{"title":"CORS compatibility check for frontend integration","prompt":"I'm building a frontend at https://app.mycompany.com that needs to call https://api.thirdparty.com — can you check whether that API allows cross-origin GET requests from my domain and what headers it returns?"},{"title":"Incident triage for unexpected CORS errors","prompt":"My team is getting CORS errors when our app at https://dashboard.internal.com tries to send DELETE requests to https://api.partner.io — can you inspect that URL's CORS configuration using our origin and the DELETE method to see what's actually allowed?"}],"resultDescription":"A JSON object containing the target URL, origin used, HTTP status, observed response headers (as key-value pairs), a preflight object with CORS headers and status, an array of severity-tagged findings (each with a code, evidence string, severity level, and recommendation), the requested method, observed timestamp, and a limitations disclaimer list.","failureModes":["URL is not publicly reachable — returns error status with no headers observed","URL requires authentication or returns non-2xx without credentials — findings reflect unauthenticated state only","CORS policy varies by route or authentication state — observed results may not reflect authenticated behavior","Invalid URL format or URL exceeding 2048 characters — validation error returned","Origin string malformed or too long — validation error","Requested method not in allowed enum — validation error","Server does not respond to OPTIONS — preflight section may be absent or show error status","Rate limiting or upstream timeouts — transient errors possible"],"whenToPreferThis":"Choose this endpoint when you need a quick, passive, read-only snapshot of what HTTP security headers and CORS configuration a public URL actually serves — without needing a full vulnerability scanner, browser simulation, or TLS certificate analysis. It is ideal for pre-deployment checks, integration compatibility validation (e.g. confirming a third-party API allows your origin), and lightweight security audits where you only need observed header evidence and actionable findings rather than deep CSP syntax parsing or authenticated session analysis.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-29T13:11:27.256Z","isFirstParty":false,"canonicalSlug":"mekler-ai-security-header-cors-policy-checker-13d888e7"}