# AgentsToolsHub HTTP Security Headers Grader

> AgentsToolsHub HTTP Security Headers Grader is a paid API for AI agents from agentstoolshub.com, paid per call via x402, $0.005/call, status unknown (last checked 2026-10-17).

Fetches a URL and grades its HTTP security headers (CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP/CORP), returning a 0–100 score, a letter grade, and actionable fix recommendations for each missing header.

## Facts

- Endpoint: GET https://agentstoolshub.com/api/v1/security/security-headers?utm_source=zero.xyz
- Price: $0.005/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-17
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/agentstoolshub-http-security-headers-grader-5ef2f0de
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_JBZgaKweCto1G2B39CnUS

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability agentstoolshub-http-security-headers-grader-5ef2f0de
```

Example prompt: Can you check the HTTP security headers for https://mycompany.com and give me a score, a letter grade, and tell me exactly which headers are missing and how to fix them?

## When to prefer this

Choose this endpoint when you need a fast, structured, scored audit of a specific website's HTTP security headers with actionable fix recommendations — especially useful in DevSecOps pipelines, pre-launch checklists, compliance audits, or when evaluating third-party sites. Prefer this over a generic HTTP request when you want graded analysis rather than raw header values.

## Known failure modes

- Invalid or unreachable URL returns an error response
- Private/internal IP addresses blocked by SSRF guard
- Malformed URL input causes validation failure
- Target site returns non-HTTP response (e.g. DNS failure)
- Rate limit exceeded for the API key

## How this service works

Fetch a URL and grade its HTTP security headers: CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and COOP/CORP. Returns a 0–100 score, a letter grade, and a concrete recommendation for every missing header. Use this when an agent needs to grade a site's HTTP security headers + fix hints.

## Output

Returns a numeric score from 0 to 100, a letter grade (e.g. A, B, C, D, F), and for each of the key HTTP security headers (CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP, CORP) — whether it is present, its current value if set, and a concrete remediation recommendation if it is missing or misconfigured.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "url"
     ],
     "properties": {
      "url": {
       "type": "string",
       "description": "URL or domain"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/agentstoolshub-http-security-headers-grader-5ef2f0de/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from agentstoolshub.com](https://www.zero.xyz/host/agentstoolshub.com/llms.txt)