{"service":"http-headers","version":"1.0.0","title":"Security headers","description":"Use when you need an http security headers audit of a website or URL, with a grade and what to fix. Do not use for vulnerability scans, TLS cipher analysis or pages behind a login. Returns JSON auditing the HTTP security headers of a public URL (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, cookies) with a grade and fixes for 0.007 USDC per call. Typical response time 2500 ms (p95). Category: Infrastructure.","paid":{"method":"POST","url":"https://x402-gateway.blackwoodstate8.workers.dev/v1/http-headers","scheme":"exact","network":"eip155:8453","asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","amount":"7000","amountUsdc":"0.007","payTo":"0xDb1828e6d91c6c9968B200e7d450545F690773A0","maxTimeoutSeconds":60},"input":{"schema":{"type":"object","properties":{"url":{"type":"string","minLength":8,"maxLength":2048,"description":"Public http(s) URL to audit, e.g. https://example.com"}},"required":["url"]},"example":{"url":"https://example.com"}},"output":{"schema":{"type":"object","properties":{"url":{"type":"string"},"finalUrl":{"type":"string"},"status":{"type":"number"},"redirects":{"type":"number"},"grade":{"type":"string"},"score":{"type":"number"},"checks":{"type":"array","items":{"type":"object","properties":{"header":{"type":"string"},"result":{"type":"string","enum":["pass","warn","fail","info"]},"value":{"type":["string","null"]},"advice":{"type":"string"}},"required":["header","result","value","advice"],"additionalProperties":false}},"cookies":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string"},"secure":{"type":"boolean"},"httpOnly":{"type":"boolean"},"sameSite":{"type":["string","null"]}},"required":["name","secure","httpOnly","sameSite"],"additionalProperties":false}},"checkedAt":{"type":"string"},"next":{"type":"object","properties":{"service":{"type":"string","description":"Service id of the suggested next paid call"},"tool":{"type":"string","description":"MCP tool name of the same call"},"method":{"type":"string","enum":["GET","POST"]},"url":{"type":"string","description":"Paid route of the next call"},"useWhen":{"type":"string","description":"When the next call is the right one"},"sample":{"type":"string","description":"Free fixed sample of the whole family"}},"required":["service","tool","method","url","useWhen","sample"],"additionalProperties":false,"description":"Suggested next paid call in the same family (call it in a loop when the task continues)"}},"required":["url","finalUrl","status","redirects","grade","score","checks","cookies","checkedAt"],"additionalProperties":false},"example":{"url":"https://example.com","finalUrl":"https://example.com/","status":200,"redirects":0,"grade":"F","score":10,"checks":[{"header":"strict-transport-security","result":"fail","value":null,"advice":"Add Strict-Transport-Security: max-age=31536000; includeSubDomains"},{"header":"content-security-policy","result":"fail","value":null,"advice":"Add a Content-Security-Policy; start with default-src 'self' and tighten from there."},{"header":"x-frame-options","result":"fail","value":null,"advice":"Add X-Frame-Options: DENY (or CSP frame-ancestors 'none') against clickjacking."},{"header":"x-content-type-options","result":"fail","value":null,"advice":"Add X-Content-Type-Options: nosniff."},{"header":"referrer-policy","result":"warn","value":null,"advice":"Add Referrer-Policy: strict-origin-when-cross-origin."},{"header":"permissions-policy","result":"warn","value":null,"advice":"Add a Permissions-Policy that turns off features you do not use (camera, microphone, geolocation)."}],"cookies":[],"checkedAt":"2026-10-17T16:49:19.296Z"}},"mcp":{"url":"https://x402-gateway.blackwoodstate8.workers.dev/mcp","tool":"blackwood_headers_audit"},"openapi":"https://x402-gateway.blackwoodstate8.workers.dev/openapi.json","status":"https://x402-gateway.blackwoodstate8.workers.dev/status.json"}