Agent Utilities
← Security checks

security.header-audit · v1.0.0

Header Audit
for your agent.

Review supplied response headers for selected security and CORS issues without echoing values.

Use this tool View JSON contract
$0.0005 / call500 micro-dollar credits
131,072 bytes max input65,536 bytes max output
Works on supplied inputNo external network fetch

Example input

{
  "headers": {
    "X-Content-Type-Options": "nosniff"
  }
}

Example output

{
  "headerNames": [
    "x-content-type-options"
  ],
  "findings": [
    {
      "rule": "missing-csp",
      "severity": "medium",
      "message": "No enforcing Content-Security-Policy header supplied."
    },
    {
      "rule": "missing-hsts",
      "severity": "medium",
      "message": "No Strict-Transport-Security header supplied; HTTPS deployment context is not checked."
    },
    {
      "rule": "missing-referrer-policy",
      "severity": "info",
      "message": "No explicit Referrer-Policy supplied."
    }
  ],
  "scope": "Audits supplied headers only; no request, TLS or browser-context verification."
}

Generated from the actual handler using this example input; this is a preview, not a paid API call. Paid responses wrap the result with a receipt and recovery expiry.

Call it from your agent

Add credits in the workspace and keep your API key in private environment storage. Use the same request ID and exact body to recover a lost response within ten minutes.

// Node.js 22+. Read the key from your private environment.
const requestId = Date.now() + '_' + crypto.randomUUID();
const response = await fetch('https://agent-utilities.agent-utilities.workers.dev/v1/tools/security.header-audit', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Authorization': 'Bearer ' + process.env.AGENT_UTILITIES_API_KEY,
    'Idempotency-Key': requestId
  },
  body: JSON.stringify({
  "headers": {
    "X-Content-Type-Options": "nosniff"
  }
})
});
const data = await response.json();
if (!response.ok) throw new Error(data.error?.message ?? 'Request failed');
console.log(data);
// On response loss, retry this SAME requestId, tool and body.
// Do not rerun the line that generates requestId for a retry.
Input JSON Schema
{
  "type": "object",
  "properties": {
    "headers": {
      "type": "object",
      "maxProperties": 100,
      "additionalProperties": {
        "type": "string",
        "maxLength": 8192
      }
    }
  },
  "required": [
    "headers"
  ],
  "additionalProperties": false
}
Output JSON Schema
{
  "type": "object",
  "properties": {
    "headerNames": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "findings": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "rule": {
            "type": "string"
          },
          "severity": {
            "type": "string"
          },
          "message": {
            "type": "string"
          }
        },
        "required": [
          "rule",
          "severity",
          "message"
        ],
        "additionalProperties": false
      }
    },
    "scope": {
      "type": "string"
    }
  },
  "required": [
    "headerNames",
    "findings",
    "scope"
  ],
  "additionalProperties": false
}

Before you integrate

Prices are experimental. The service currently allows 1,000 new calls per day across all accounts. Failed operations return reserved credits. This tool may process sensitive content; use sanitized samples when possible. Successful results are encrypted for ten-minute retry recovery. Review data handling and service limits.

Related tools

security $0.0005 / call

Secret Scan

Detect five families of credential patterns with fully masked findings.

security.secret-scan

security $0.0005 / call

Secret Redact

Replace detected credential patterns with redaction markers.

security.secret-redact

security $0.0003 / call

JWT Inspect

Decode untrusted JWT claims and optionally compare timestamps; never verifies a signature.

security.jwt-inspect