{"openapi":"3.1.0","info":{"title":"http-security-headers-grade","version":"0.1.0","description":"Fetches a public http(s) URL (GET, up to 5 redirects, 10s timeout, body never read) and grades its security headers A+ to F. Returns score, present and missing headers, per-header findings with copy-paste fix values, and cookie flag issues.","x-guidance":"HTTP Security Headers Grade fetches a public URL (GET, up to 5 redirects, headers only, 10s timeout) and grades its security headers from A+ to F. It checks HSTS (max-age, includeSubDomains, preload), CSP (presence, unsafe-inline, wildcards), X-Frame-Options or frame-ancestors, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP, COEP, CORP and Set-Cookie flags. Returns score, present and missing lists, per-header findings and copy-paste fix values. SSRF-guarded. Tools: `grade_headers`.","contact":{"email":"jeff@fosterinstruments.com"}},"servers":[{"url":"https://http-security-headers-grade.x402supply.com"}],"paths":{"/mcp":{"post":{"operationId":"http-security-headers-grade_call","summary":"Call http-security-headers-grade via MCP tools/call","tags":["http-security-headers-grade"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["jsonrpc","id","method","params"],"properties":{"jsonrpc":{"const":"2.0"},"id":{"type":["string","number"]},"method":{"const":"tools/call"},"params":{"type":"object","required":["name","arguments"],"properties":{"name":{"const":"grade_headers"},"arguments":{"type":"object","properties":{"url":{"type":"string","minLength":4,"maxLength":2048,"description":"Public http or https URL to grade, e.g. https://github.com"}},"required":["url"],"additionalProperties":false,"$schema":"http://json-schema.org/draft-07/schema#"}}}}}}}},"responses":{"200":{"description":"Tool result","content":{"application/json":{"schema":{"type":"object","description":"JSON-RPC 2.0 response envelope. `result.content[0].text` is a JSON-encoded string matching the schema in `x-mcp-result-schema`.","properties":{"jsonrpc":{"const":"2.0"},"id":{"type":["string","number"]},"result":{"type":"object","properties":{"content":{"type":"array","items":{"type":"object","properties":{"type":{"const":"text"},"text":{"type":"string"}}}}}}},"x-mcp-result-schema":{"type":"object","required":["url","finalUrl","status","redirects","grade","score","present","missing","findings","cookies","fixes"],"properties":{"url":{"type":"string"},"finalUrl":{"type":"string"},"status":{"type":"integer"},"redirects":{"type":"integer"},"grade":{"type":"string","enum":["A+","A","B","C","D","F"]},"score":{"type":"integer"},"present":{"type":"array","items":{"type":"string"}},"missing":{"type":"array","items":{"type":"string"}},"findings":{"type":"array","items":{"type":"object","required":["header","status","points","maxPoints","message"],"properties":{"header":{"type":"string"},"status":{"type":"string","enum":["pass","warn","fail"]},"points":{"type":"number"},"maxPoints":{"type":"number"},"value":{"type":["string","null"]},"message":{"type":"string"},"fix":{"type":["string","null"]}}}},"cookies":{"type":"array","items":{"type":"object","required":["name","secure","httpOnly","sameSite","issues"],"properties":{"name":{"type":"string"},"secure":{"type":"boolean"},"httpOnly":{"type":"boolean"},"sameSite":{"type":["string","null"]},"issues":{"type":"array","items":{"type":"string"}}}}},"fixes":{"type":"object","additionalProperties":{"type":"string"}}}}}}}},"402":{"description":"Payment Required","content":{"application/json":{"schema":{"type":"object","properties":{"x402Version":{"type":"integer"},"error":{"type":"string"},"accepts":{"type":"array"}}}}}}},"x-payment-info":{"price":{"mode":"fixed","currency":"USD","amount":"0.01"},"protocols":[{"x402":{}}]}}},"/tools/grade_headers":{"post":{"operationId":"http-security-headers-grade_grade_headers_http","summary":"Fetches a public http(s) URL (GET, up to 5 redirects, 10s timeout, body never read) and grades its security headers A+ to F. Returns score, present and missing headers, per-header findings with copy-paste fix values, and cookie flag issues.","tags":["http-security-headers-grade"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"url":{"type":"string","minLength":4,"maxLength":2048,"description":"Public http or https URL to grade, e.g. https://github.com"}},"required":["url"],"additionalProperties":false},"example":{"url":"https://example.com"}}}},"responses":{"200":{"description":"Tool result (plain JSON, not MCP-wrapped)","content":{"application/json":{"schema":{"type":"object","required":["url","finalUrl","status","redirects","grade","score","present","missing","findings","cookies","fixes"],"properties":{"url":{"type":"string"},"finalUrl":{"type":"string"},"status":{"type":"integer"},"redirects":{"type":"integer"},"grade":{"type":"string","enum":["A+","A","B","C","D","F"]},"score":{"type":"integer"},"present":{"type":"array","items":{"type":"string"}},"missing":{"type":"array","items":{"type":"string"}},"findings":{"type":"array","items":{"type":"object","required":["header","status","points","maxPoints","message"],"properties":{"header":{"type":"string"},"status":{"type":"string","enum":["pass","warn","fail"]},"points":{"type":"number"},"maxPoints":{"type":"number"},"value":{"type":["string","null"]},"message":{"type":"string"},"fix":{"type":["string","null"]}}}},"cookies":{"type":"array","items":{"type":"object","required":["name","secure","httpOnly","sameSite","issues"],"properties":{"name":{"type":"string"},"secure":{"type":"boolean"},"httpOnly":{"type":"boolean"},"sameSite":{"type":["string","null"]},"issues":{"type":"array","items":{"type":"string"}}}}},"fixes":{"type":"object","additionalProperties":{"type":"string"}}}},"example":{"url":"https://example.com","finalUrl":"https://example.com/","status":200,"redirects":0,"grade":"F","score":0,"present":[],"missing":["strict-transport-security","content-security-policy","x-frame-options","x-content-type-options","referrer-policy","permissions-policy","cross-origin-opener-policy","cross-origin-embedder-policy","cross-origin-resource-policy"],"findings":[{"header":"strict-transport-security","status":"fail","points":0,"maxPoints":18,"value":null,"message":"HSTS header is missing.","fix":"Strict-Transport-Security: max-age=63072000; includeSubDomains; preload"},{"header":"content-security-policy","status":"fail","points":0,"maxPoints":25,"value":null,"message":"Content-Security-Policy is missing.","fix":"Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"},{"header":"x-frame-options","status":"fail","points":0,"maxPoints":10,"value":null,"message":"No X-Frame-Options or CSP frame-ancestors, so the page can be framed (clickjacking).","fix":"X-Frame-Options: DENY"},{"header":"x-content-type-options","status":"fail","points":0,"maxPoints":10,"value":null,"message":"X-Content-Type-Options is missing.","fix":"X-Content-Type-Options: nosniff"},{"header":"referrer-policy","status":"fail","points":0,"maxPoints":10,"value":null,"message":"Referrer-Policy is missing.","fix":"Referrer-Policy: strict-origin-when-cross-origin"},{"header":"permissions-policy","status":"fail","points":0,"maxPoints":8,"value":null,"message":"Permissions-Policy is missing.","fix":"Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=()"},{"header":"cross-origin-opener-policy","status":"fail","points":0,"maxPoints":5,"value":null,"message":"Cross-Origin-Opener-Policy is missing.","fix":"Cross-Origin-Opener-Policy: same-origin"},{"header":"cross-origin-embedder-policy","status":"fail","points":0,"maxPoints":4,"value":null,"message":"Cross-Origin-Embedder-Policy is missing.","fix":"Cross-Origin-Embedder-Policy: require-corp"},{"header":"cross-origin-resource-policy","status":"fail","points":0,"maxPoints":4,"value":null,"message":"Cross-Origin-Resource-Policy is missing.","fix":"Cross-Origin-Resource-Policy: same-origin"}],"cookies":[],"fixes":{"strict-transport-security":"Strict-Transport-Security: max-age=63072000; includeSubDomains; preload","content-security-policy":"Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'","x-frame-options":"X-Frame-Options: DENY","x-content-type-options":"X-Content-Type-Options: nosniff","referrer-policy":"Referrer-Policy: strict-origin-when-cross-origin","permissions-policy":"Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=()","cross-origin-opener-policy":"Cross-Origin-Opener-Policy: same-origin","cross-origin-embedder-policy":"Cross-Origin-Embedder-Policy: require-corp","cross-origin-resource-policy":"Cross-Origin-Resource-Policy: same-origin"}}}}},"400":{"description":"Invalid input","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"},"message":{"type":"string"}}}}}},"402":{"description":"Payment Required","content":{"application/json":{"schema":{"type":"object","properties":{"x402Version":{"type":"integer"},"error":{"type":"string"},"accepts":{"type":"array"}}}}}}},"x-payment-info":{"price":{"mode":"fixed","currency":"USD","amount":"0.01"},"protocols":[{"x402":{}}]}}}}}