# Mekler AI Security Header & CORS Policy Checker

> Mekler AI Security Header & CORS Policy Checker is a paid API for AI agents from api.mekler.ai, paid per call via x402, $0.005/call, status unknown (last checked 2026-10-29).

Passively inspects a public URL's HTTP security headers and cross-origin (CORS) configuration by issuing a GET and a credential-free OPTIONS preflight, returning observed headers and severity-tagged findings.

## Facts

- Endpoint: POST https://api.mekler.ai/v1/web/headers/check-security-policy?utm_source=zero.xyz
- Price: $0.005/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-29
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/mekler-ai-security-header-cors-policy-checker-13d888e7
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_esyQ2xina6nSuA8TRRcyT

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability mekler-ai-security-header-cors-policy-checker-13d888e7 -d '<json body>'
```

Example prompt: Can you check the security headers and CORS policy on https://example.com for me? Use https://myapp.com as the origin and check if it allows POST requests.

## When to prefer this

Choose this endpoint when you need a quick, passive, read-only snapshot of what HTTP security headers and CORS configuration a public URL actually serves — without needing a full vulnerability scanner, browser simulation, or TLS certificate analysis. It is ideal for pre-deployment checks, integration compatibility validation (e.g. confirming a third-party API allows your origin), and lightweight security audits where you only need observed header evidence and actionable findings rather than deep CSP syntax parsing or authenticated session analysis.

## Known failure modes

- URL is not publicly reachable — returns error status with no headers observed
- URL requires authentication or returns non-2xx without credentials — findings reflect unauthenticated state only
- CORS policy varies by route or authentication state — observed results may not reflect authenticated behavior
- Invalid URL format or URL exceeding 2048 characters — validation error returned
- Origin string malformed or too long — validation error
- Requested method not in allowed enum — validation error
- Server does not respond to OPTIONS — preflight section may be absent or show error status
- Rate limiting or upstream timeouts — transient errors possible

## How this service works

Inspect one public URL for observed security headers and cross-origin configuration. Send passive GET and credential-free OPTIONS with a supplied origin, requested method and optional header names; return exact selected headers and evidence-linked findings. No authorization/cookies, exploit attempts, state-changing requests, browser enforcement guarantee or full CSP/TLS analysis.

## Output

A JSON object containing the target URL, origin used, HTTP status, observed response headers (as key-value pairs), a preflight object with CORS headers and status, an array of severity-tagged findings (each with a code, evidence string, severity level, and recommendation), the requested method, observed timestamp, and a limitations disclaimer list.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "url": {
   "type": "string",
   "maxLength": 2048
  },
  "origin": {
   "type": "string",
   "default": "https://mekler.ai",
   "maxLength": 2048
  },
  "request_id": {
   "type": "string",
   "pattern": "^[A-Za-z0-9_-]{16,64}$"
  },
  "request_headers": {
   "type": "array",
   "items": {
    "type": "string",
    "pattern": "^[a-z0-9-]{1,64}$"
   },
   "default": [],
   "maxItems": 20
  },
  "requested_method": {
   "enum": [
    "GET",
    "HEAD",
    "POST",
    "PUT",
    "PATCH",
    "DELETE"
   ],
   "type": "string",
   "default": "GET"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "url": "https://mekler.ai/",
  "origin": "https://mekler.ai",
  "status": "ok",
  "findings": [
   {
    "code": "hsts_absent",
    "evidence": "No HSTS response header.",
    "severity": "info",
    "recommendation": "Consider HSTS after confirming HTTPS coverage for the intended host scope."
   },
   {
    "code": "csp_absent",
    "evidence": "No enforced CSP response header.",
    "severity": "info",
    "recommendation": "Consider a tested CSP appropriate to the application; report-only is not enforcement."
   }
  ],
  "preflight": {
   "url": "https://mekler.ai/",
   "headers": {
    "x-content-type-options": "nosniff",
    "access-control-allow-origin": "*",
    "access-control-allow-methods": "GET, HEAD"
   },
   "http_status": 200
  },
  "http_status": 200,
  "limitations": [
   "Passive GET and credential-free OPTIONS observations only; no cookies, authorization, exploit attempts or state-changing method is sent.",
   "Observed policies may vary by route, origin, browser and authentication. This is not a vulnerability scan or a browser enforcement/safety certification.",
   "CSP syntax/effective-policy analysis and TLS certificate inspection are outside this operation."
  ],
  "observed_at": "2026-10-20T00:00:00Z",
  "request_headers": [],
  "requested_method": "GET",
  "response_headers": {
   "x-content-type-options": "nosniff",
   "access-control-allow-origin": "*",
   "access-control-allow-methods": "GET, HEAD"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/mekler-ai-security-header-cors-policy-checker-13d888e7/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.mekler.ai](https://www.zero.xyz/host/api.mekler.ai/llms.txt)