# Tanod sitepeek — Security Headers Grader

> Tanod sitepeek — Security Headers Grader is a paid API for AI agents from tanod.dev, paid per call via x402, $0.002/call, status unknown (last checked 2026-10-11).

Fetches the HTTP response headers of a given URL and returns a letter grade (A–F) plus a score evaluating HSTS, CSP, framing, content-type, referrer, permissions, cross-origin, and cookie security headers.

## Facts

- Endpoint: POST https://tanod.dev/v1/headers?utm_source=zero.xyz
- Price: $0.002/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-11
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/tanod-sitepeek-security-headers-grader-60ae4091
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_ZowFH13gbF8y2njtcivwq

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability tanod-sitepeek-security-headers-grader-60ae4091 -d '<json body>'
```

Example prompt: Can you check the security headers on https://example.com and tell me what grade it gets — especially whether HSTS, CSP, and cookie headers are properly set?

## When to prefer this

Choose this endpoint when you need a quick, structured security-header grade for a single public URL without running a full penetration test or crawl. It is ideal for pre-launch checks, vendor assessments, or CI/CD gates where you need a machine-readable score and per-header breakdown. Prefer it over generic HTTP-fetching tools when the goal is specifically to evaluate defensive HTTP headers rather than page content or performance.

## Known failure modes

- URL is not reachable or returns a non-2xx response — grading may fail or return partial results
- Private/internal URLs (localhost, RFC-1918 ranges) are not publicly accessible and will fail
- Malformed or non-HTTP(S) URL input returns a validation error
- Redirect chains that result in an unreachable final destination cause failure
- Intermittent network timeouts for slow or flaky origin servers

## How this service works

One MCP server and HTTP API with 193 pay-per-call tools for AI agents (security checks, chain data, finance, aviation, documents), plus free uptime and MikroTik monitoring and 130+ free browser tools. No signup; free daily tier. Operated by an AI.

## Output

Returns a numeric score and letter grade (A through F) for the final HTTP response headers of the submitted URL, broken down by individual header categories: HSTS, Content Security Policy, X-Frame-Options/framing, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, cross-origin headers (CORP/COEP/COOP), and cookie security attributes.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "url": {
   "type": "string",
   "maxLength": 2048,
   "minLength": 1,
   "description": "Public http(s) URL whose response headers are graded (the final response after redirects)."
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "csp": {
   "value": "default-src 'none'; base-uri 'self'; child-src github.githubassets.com ...",
   "present": true,
   "policies": 1,
   "directives": [
    "base-uri",
    "child-src",
    "connect-src",
    "default-src",
    "font-src",
    "form-action",
    "frame-ancestors",
    "frame-src",
    "img-src",
    "manifest-src",
    "media-src",
    "script-src",
    "style-src",
    "upgrade-insecure-requests",
    "worker-src"
   ],
   "report_only": false,
   "unsafe_eval": false,
   "unsafe_inline": false,
   "frame_ancestors": "'none'",
   "wildcard_sources": false,
   "missing_directives": [],
   "scripts_restricted": true,
   "object_src_restricted": true
  },
  "url": "https://github.com",
  "hsts": {
   "valid": true,
   "value": "max-age=31536000; includeSubdomains; preload",
   "max_age": 31536000,
   "preload": true,
   "present": true,
   "preload_eligible": true,
   "include_subdomains": true
  },
  "note": "one response's headers only; pages, APIs and error responses of the same site can differ",
  "grade": "A",
  "https": true,
  "score": 90,
  "status": 200,
  "cookies": {
   "count": 3,
   "items": [
    {
     "name": "_gh_sess",
     "secure": true,
     "httponly": true,
     "samesite": "Lax",
     "host_prefix": false,
     "secure_prefix": false
    },
    {
     "name": "_octo",
     "secure": true,
     "httponly": false,
     "samesite": "Lax",
     "host_prefix": false,
     "secure_prefix": false
    }
   ],
   "truncated": false
  },
  "final_url": "https://github.com",
  "redirects": [],
  "deductions": [
   {
    "code": "permissions_policy_missing",
    "points": 5,
    "reason": "no Permissions-Policy header"
   },
   {
    "code": "cookie_not_httponly",
    "points": 5,
    "reason": "1 cookie(s) without HttpOnly (fine only if scripts must read them)"
   }
  ],
  "disclosure": {
   "server": "github.com",
   "x_powered_by": null,
   "x_aspnet_version": null
  },
  "cross_origin": {
   "opener_policy": null,
   "embedder_policy": null,
   "resource_policy": null
  },
  "referrer_policy": {
   "note": null,
   "value": "origin-when-cross-origin, strict-origin-when-cross-origin",
   "effective": "strict-origin-when-cross-origin"
  },
  "x_frame_options": {
   "valid": true,
   "value": "DENY"
  },
  "untrusted_content": true,
  "upgraded_to_https": false,
  "permissions_policy": {
   "value": null,
   "present": false
  },
  "x_content_type_options": {
   "valid": true,
   "value": "n
… (truncated)
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/tanod-sitepeek-security-headers-grader-60ae4091/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from tanod.dev](https://www.zero.xyz/host/tanod.dev/llms.txt)