# Lookproof CSP Parser

> Lookproof CSP Parser is a paid API for AI agents from api.lookproof.dev, paid per call via x402, $0.002/call, status unknown (last checked 2026-10-31).

Parses a Content-Security-Policy header value offline, identifying directives, sources, unsafe flags, wildcards, and missing critical entries per CSP Level 3.

## Facts

- Endpoint: POST https://api.lookproof.dev/v1/http/csp-parse?utm_source=zero.xyz
- Price: $0.002/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-31
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/lookproof-csp-parser-d7a1855c
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_A4fhztHRP1kQi5TZvHKF_

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability lookproof-csp-parser-d7a1855c -d '<json body>'
```

Example prompt: Can you parse this CSP header for me and flag anything unsafe or missing — like unsafe-inline, wildcard script sources, or missing default-src, object-src, or base-uri: "default-src 'self'; script-src 'self' 'unsafe-inline' https:; object-src 'none'"?

## When to prefer this

Choose this endpoint when you need offline, deterministic, standards-accurate CSP Level 3 parsing without making live DNS or network requests. It is ideal for CI/CD pipelines, security review workflows, or any agent that writes or audits CSP headers before deployment. Prefer it over a generic security scanner when you specifically need structured directive-by-directive CSP analysis.

## Known failure modes

- Empty or missing header field returns a validation error
- Header exceeding 8192 characters is rejected
- Malformed JSON input returns a 400-level error
- Completely blank CSP string returns a parse error

## How this service works

Check SPF, DMARC, DKIM, MTA-STS, DNSSEC and more, with results that explain what was found and why. Free browser checks and a pay-per-request API with x402.

## Output

A structured breakdown of the parsed CSP including: each directive and its sources, presence of unsafe-inline and unsafe-eval, wildcard and scheme-only sources in script or plugin directives, which critical directives (default-src, object-src, base-uri) are missing, and whether the policy is in report-only mode.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "header": {
   "type": "string",
   "title": "Header",
   "maxLength": 8192,
   "minLength": 1
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/lookproof-csp-parser-d7a1855c/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.lookproof.dev](https://www.zero.xyz/host/api.lookproof.dev/llms.txt)