ToolVet
80trust / 100

Cors Preflight

by Forest Web in Weather & location

x402 APIPassing, checked 1 h ago

Send exactly one bounded non-credentialed browser-style CORS OPTIONS preflight to the supplied public URL and normalize the observed Access-Control-Allow-* response into origin, method and header decisions. Redirects are not followed, so the result describes the exact resource URL. Forest does not send cookies or Authorization, invoke the requested resource afterward, run JavaScript, or guarantee browser/runtime success beyond the observed response. Base mainnet USDC

POST https://http--forest-gas-station-mainnet--lcjl27p8lmjs.code.run/cors/preflight

Last 30 days

All checks passedSome failedAll failedNot checked
Uptime
100%
Response time
42 ms typical, 102 ms slowest 5%
Last check
1 h ago
Next check
any minute now

How to call it

# See the payment challenge (nothing is charged)
curl -i -X POST "https://http--forest-gas-station-mainnet--lcjl27p8lmjs.code.run/cors/preflight" \
  -H "content-type: application/json" \
  -d '{"origin":"https://forestfactory.dev","requested_headers":["content-type","x-request-id"],"requested_method":"POST","url":"https://http--forest-gas-station-mainnet--lcjl27p8lmjs.code.run/fixtures/cors"}'
import { wrapFetchWithPayment } from "@x402/fetch";
import { x402Client } from "@x402/core/client";
import { ExactEvmScheme } from "@x402/evm/exact/client";
import { privateKeyToAccount } from "viem/accounts";

const client = new x402Client().register(
  "eip155:8453",
  new ExactEvmScheme(privateKeyToAccount(process.env.AGENT_KEY)),
);
const pay = wrapFetchWithPayment(fetch, client);

// Not sure it's safe to pay? Preflight it first for $0.005:
// GET https://toolvet.app/api/v1/check?url=https%3A%2F%2Fhttp--forest-gas-station-mainnet--lcjl27p8lmjs.code.run%2Fcors%2Fpreflight
const res = await pay("https://http--forest-gas-station-mainnet--lcjl27p8lmjs.code.run/cors/preflight", {
  method: "POST",
  headers: { "content-type": "application/json" },
  body: JSON.stringify({"origin":"https://forestfactory.dev","requested_headers":["content-type","x-request-id"],"requested_method":"POST","url":"https://http--forest-gas-station-mainnet--lcjl27p8lmjs.code.run/fixtures/cors"}),
});
console.log(await res.json());

Example input

{
  "origin": "https://forestfactory.dev",
  "requested_headers": [
    "content-type",
    "x-request-id"
  ],
  "requested_method": "POST",
  "url": "https://http--forest-gas-station-mainnet--lcjl27p8lmjs.code.run/fixtures/cors"
}

Example output

{
  "capability": "cors.preflight",
  "data": {
    "allowed_headers": [],
    "allowed_methods": [],
    "allowed_origin": "example",
    "blockers": [],
    "credentials_allowed": false,
    "final_url": "example",
    "headers_allowed": false,
    "method_allowed": false,
    "origin_allowed": false,
    "preflight_passes": false,
    "provider_request_count": 1,
    "redirect_count": 0,
    "scope": "observed_noncredentialed_cors_preflight_only",
    "status": 100,
    "warnings": []
  },
  "meta": {
    "cache": "miss",
    "checked_at": "2026-01-01T00:00:00.000Z",
    "duration_ms": 0,
    "provider": "safe-http-options"
  },
  "ok": true,
  "version": "1"
}

Security scan

  • No findings. We scan names, descriptions and tool definitions for hidden instructions and other prompt-injection patterns.

Recent checks

WhenResultHTTPTimePrice
1 h agoPassed40240 ms$0.002
5 h agoPassed40242 ms$0.002
9 h agoPassed40242 ms$0.002
12 h agoPassed40239 ms$0.002
16 h agoPassed402215 ms$0.002
20 h agoPassed40247 ms$0.002
23 h agoPassed40239 ms$0.002
28 h agoPassed402102 ms$0.002