{"ok":true,"result":{"slug":"security-headers-checker","name":"Security Headers Checker","summary":"Grade pasted HTTP response headers (A+ to F) for security: CSP, HSTS, framing, nosniff, Referrer-Policy, Permissions-Policy, cross-origin policies, cookies and information leaks. Nothing is fetched.","description":"Paste HTTP response headers to grade them A+ to F: HSTS, CSP, framing, cookies, COOP, CORP and version leaks, with fixes for Nginx and Apache. Fetches nothing.","method":"POST","endpoint":"/api/v1/tools/security-headers-checker","plan":"free","mcpName":"security_headers_checker","input":{"type":"object","additionalProperties":false,"properties":{"headers":{"type":"string","description":"Raw response headers, e.g. the output of curl -I https://example.com or a copy from browser devtools. If several responses are pasted (curl -IL), the last is graded.","maxLength":200000},"server":{"type":"string","description":"Also return a recommended header config for this server: nginx, apache, or none.","default":"none","enum":["none","nginx","apache"],"maxLength":200000}},"required":["headers"]},"example":{"headers":"HTTP/2 200\ncontent-type: text/html; charset=utf-8\nstrict-transport-security: max-age=31536000; includeSubDomains\nx-content-type-options: nosniff\nx-frame-options: SAMEORIGIN\nreferrer-policy: strict-origin-when-cross-origin\nserver: nginx/1.25.3"},"randomOutput":false,"network":false,"docs":"https://pithlab.com/developers/tools/security-headers-checker","page":"https://pithlab.com/tools/security-headers-checker"}}