Security Http Headers

Fetch a URL and grade its HTTP security headers.

Overview

Fetch a URL and grade its HTTP security headers. Pass url (scheme optional — defaults to https). Returns an overall letter grade + score, the list of present/missing headers, and a per-header analysis with the live value and specific issues for: Strict-Transport-Security (HSTS max-age/includeSubDomains), Content-Security-Policy (flags 'unsafe-inline'/'unsafe-eval'/missing default-src), X-Frame-Options or CSP frame-ancestors (clickjacking), X-Content-Type-Options (nosniff), Referrer-Policy, Permissions-Policy, and Cross-Origin-Opener/Resource-Policy. Also flags Server/X-Powered-By info disclosure. Analyzed from the target's LIVE response headers through an SSRF-guarded fetch (private/loopback targets refused) — an LLM cannot see a site's current headers. For web-app security review, vendor assessment, and CI gates.

Endpoint

Method	Endpoint	Price	Description
GET	/v1/marketplace/api/security-http-headers	$0.00207	Invoke Security Http Headers (Llm) and return the upstream response.

How to call it

Requests are paid per call over the x402 protocol. Call the endpoint, receive a 402 Payment Required quote, then repeat the request with the signed payment header. The SDKs do both steps for you.

# 1. Ask for a quote
curl -i https://api.jarvisclaw.ai/v1/marketplace/api/security-http-headers

# 2. Pay it (the SDK signs and retries for you)
curl -H "X-PAYMENT: <signed-payload>" https://api.jarvisclaw.ai/v1/marketplace/api/security-http-headers

Open in the marketplace