# agent402.tools HTTP Security Headers Analyzer

> agent402.tools HTTP Security Headers Analyzer is a paid API for AI agents from agent402.tools, paid per call via x402, $0.003/call, status unknown (last checked 2026-09-15).

Fetches HTTP response headers from a URL and performs a scored security analysis covering HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and COOP/CORP/COEP.

## Facts

- Endpoint: POST https://agent402.tools/api/http-headers
- Price: $0.003/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/agent402-tools-http-security-headers-analyzer-ed0aefa7
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_-0qE4kW9ZVX9BjLfHgWke

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability agent402-tools-http-security-headers-analyzer-ed0aefa7 -d '<json body>'
```

Example prompt: Can you fetch the HTTP headers from https://example.com and give me a security score with analysis of their HSTS, CSP, X-Frame-Options, and any other security headers — I want to know what's missing or weak?

## When to prefer this

Choose this endpoint when you need a structured security header audit with a numeric score and per-header analysis rather than just raw header values. Ideal for automated security checks, CI/CD pipelines, or compliance reviews where you need to know not just what headers are present but whether they are correctly configured (e.g., weak HSTS max-age, missing CSP directives).

## Known failure modes

- URL is unreachable or times out — error returned with no headers or score
- Non-public or localhost URL provided — rejected or no response
- Invalid URL format — validation error before any request is made
- HTTP redirect loops or TLS errors — connection failure reported

## How this service works

Fetch a URL and return every response header plus a security analysis: HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP/CORP/COEP. Scores 0–100 by presence, flags weak HSTS, and warns on Server/X-Powered-By identity leaks. SSRF-protected.

## Output

Returns all HTTP response headers from the target URL plus a 0–100 security score based on the presence and quality of headers like HSTS (with weak-configuration flags), CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP, CORP, and COEP, along with warnings for information-leaking headers like Server or X-Powered-By.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "url": {
   "type": "string",
   "description": "Public http(s) URL to probe"
  },
  "method": {
   "type": "string",
   "description": "GET or HEAD (default GET)"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "url": "https://example.com/",
  "status": 200,
  "headers": {
   "server": "ECAcc (nyd/D17C)",
   "content-type": "text/html; charset=UTF-8"
  },
  "finalUrl": "https://example.com/",
  "security": {
   "score": 0,
   "findings": [
    {
     "value": null,
     "header": "HSTS",
     "present": false
    }
   ],
   "warnings": [
    "Server header leaks identity: ECAcc (nyd/D17C)"
   ]
  },
  "fetchedAt": "2026-06-19T22:00:00.000Z",
  "redirected": false,
  "statusText": "OK",
  "httpVersion": null
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/agent402-tools-http-security-headers-analyzer-ed0aefa7/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from agent402.tools](https://www.zero.xyz/host/agent402.tools/llms.txt)