# Concierge Agent — Security Headers Checker

> Concierge Agent — Security Headers Checker is a paid API for AI agents from conc-exe.xyz, paid per call via x402, $0.02/call, status unknown (last checked 2026-09-15).

Passively audits the HTTP security headers of an external HTTPS origin and returns a graded summary of which headers are present or missing.

## Facts

- Endpoint: POST https://conc-exe.xyz/api/concierge-security-headers
- Price: $0.02/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/concierge-agent-security-headers-checker-a5b4d23e
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_e8VlzzvgPC_gsG8_VD3jK

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability concierge-agent-security-headers-checker-a5b4d23e -d '<json body>'
```

Example prompt: Can you audit the security headers on https://app.example.com and tell me which headers are present or missing, plus the overall security grade? I have permission to check this site.

## When to prefer this

Use this endpoint when you need a quick, passive, pay-per-call security header audit on an external HTTPS origin without setting up a dedicated scanning tool. Ideal for AI agents performing automated security checks on web properties where the caller can attest authorization.

## Known failure modes

- Missing or false 'authorized' field causes rejection — caller must attest permission
- Target URL pointing to conc-exe.xyz itself is blocked by design
- Invalid or non-HTTPS target origin returns an error
- Hostname not on allowlist (if allowlist provided) is rejected
- Target site unreachable or times out returns an error response

## How this service works

Passive HTTP security header review for an authorized external target (no exploitation; platform hosts blocked)

## Output

Returns a JSON object with a list of individual header checks (each with ID, header name, and presence boolean), the target origin and hostname, an overall grade (e.g. 'moderate'), counts of total vs. present headers, and a disclaimer noting the review is passive only.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "target": {
   "type": "string",
   "description": "Authorized external https origin (never conc-exe.xyz)"
  },
  "allowlist": {
   "type": "array",
   "items": {
    "type": "string"
   },
   "description": "Optional hostname allowlist"
  },
  "authorized": {
   "type": "boolean",
   "description": "Must be true — caller attests permission"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "ok": true,
  "kind": "security-headers",
  "checks": [
   {
    "id": "x-content-type-options",
    "header": "x-content-type-options",
    "present": true
   }
  ],
  "target": {
   "origin": "https://app.example.com",
   "hostname": "app.example.com"
  },
  "summary": {
   "grade": "moderate",
   "total": 6,
   "present": 4
  },
  "disclaimer": "Passive header review only."
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/concierge-agent-security-headers-checker-a5b4d23e/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from conc-exe.xyz](https://www.zero.xyz/host/conc-exe.xyz/llms.txt)