# MoneyTools Security Headers Audit

> MoneyTools Security Headers Audit is a paid API for AI agents from tools.moneytools.dev, paid per call via x402, $0.002/call, status unknown (last checked 2026-11-05).

Audits a URL's HTTP security headers and grades them A–F, checking HSTS, CSP, clickjacking, nosniff, referrer policy, cookie flags, CORS, and version leaks with fix recommendations.

## Facts

- Endpoint: GET https://tools.moneytools.dev/v1/security-headers?utm_source=zero.xyz
- Price: $0.002/call
- Payment: x402
- Status: unknown
- Last checked: 2026-11-05
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/moneytools-security-headers-audit-12cad929
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_RAFNKhsacP5SsBsA3QWoi

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability moneytools-security-headers-audit-12cad929
```

Example prompt: Can you do a full security headers audit on https://myapp.example.com and tell me the grade plus any issues with CSP, HSTS, or cookie flags?

## When to prefer this

Choose this endpoint when you need a quick, structured, graded audit of a URL's HTTP response security headers with specific findings and fixes — especially for HSTS, CSP, clickjacking, cookie flags, and CORS. It is ideal for CI/CD pipeline checks, pre-launch reviews, compliance reporting, or competitive analysis. Prefer this over manual header inspection tools when you need machine-readable results with an overall grade and per-header recommendations in a single call.

## Known failure modes

- Target URL is unreachable or returns a non-HTTP error — not charged
- Invalid or malformed URL input — returns error without charge
- Target site blocks requests from audit tools — headers may be incomplete
- Free tier (10/day) exhausted and no payment method provided — returns HTTP 402
- Network timeout reaching the target URL

## How this service works

Security headers audit (A-F): Graded audit of HSTS, CSP (unsafe-inline/eval, wildcards), clickjacking, nosniff, Referrer/Permissions-Policy, cookie flags, version leaks and CORS misconfig, with fixes. Free tier 10/day; then $0.002 via x402 (HTTP 402 + PAYMENT-REQUIRED) or X-API-Key credits. Not charged on failure. $0.002 USDC per call via x402 on Base. Run by MoneyTools.

## Output

A JSON object containing an A–F security grade and detailed findings for each header category: HSTS presence and configuration, CSP analysis (unsafe-inline, eval, wildcard usage), clickjacking (X-Frame-Options), X-Content-Type-Options (nosniff), Referrer-Policy, Permissions-Policy, cookie security flags (Secure, HttpOnly, SameSite), CORS misconfiguration indicators, and server version leak signals — along with actionable fix recommendations for each issue found. Also includes payment metadata (charged boolean, network, amount, transaction ID).

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "const": "http"
    },
    "method": {
     "const": "GET"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "url"
     ],
     "properties": {
      "url": {
       "type": "string",
       "examples": [
        "https://moneytools.dev"
       ],
       "description": "page URL"
      }
     }
    }
   }
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "json"
    },
    "example": {
     "type": "object",
     "properties": {
      "payment": {
       "type": "object",
       "properties": {
        "charged": {
         "type": "boolean"
        },
        "network": {
         "type": "string"
        },
        "amountUsd": {
         "type": "string"
        },
        "transaction": {
         "type": [
          "string",
          "null"
         ]
        }
       }
      },
      "freeTier": {
       "type": "object"
      },
      "_moneytools": {
       "type": "object",
       "description": "optional plan / partner hints"
      }
     },
     "description": "Tool-specific JSON result (see llms.txt / openapi.json). Always includes payment info.",
     "additionalProperties": true
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json"
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/moneytools-security-headers-audit-12cad929/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from tools.moneytools.dev](https://www.zero.xyz/host/tools.moneytools.dev/llms.txt)