Headers

Last 30 days

Uptime

100%

Response time

273 ms typical, 279 ms slowest 5%

Last check

3 h ago

Next check

any minute now

How to call it

# See the payment challenge (nothing is charged)
curl -i -X POST "https://tanod.dev/v1/headers" \
  -H "content-type: application/json" \
  -d '{"url":"https://github.com"}'

import { wrapFetchWithPayment } from "@x402/fetch";
import { x402Client } from "@x402/core/client";
import { ExactEvmScheme } from "@x402/evm/exact/client";
import { privateKeyToAccount } from "viem/accounts";

const client = new x402Client().register(
  "eip155:8453",
  new ExactEvmScheme(privateKeyToAccount(process.env.AGENT_KEY)),
);
const pay = wrapFetchWithPayment(fetch, client);

// Not sure it's safe to pay? Preflight it first for $0.005:
// GET https://toolvet.app/api/v1/check?url=https%3A%2F%2Ftanod.dev%2Fv1%2Fheaders
const res = await pay("https://tanod.dev/v1/headers", {
  method: "POST",
  headers: { "content-type": "application/json" },
  body: JSON.stringify({"url":"https://github.com"}),
});
console.log(await res.json());

Example input

{
  "url": "https://github.com"
}

Example output

{
  "cookies": {
    "count": 3,
    "items": [
      {
        "host_prefix": false,
        "httponly": true,
        "name": "_gh_sess",
        "samesite": "Lax",
        "secure": true,
        "secure_prefix": false
      },
      {
        "host_prefix": false,
        "httponly": false,
        "name": "_octo",
        "samesite": "Lax",
        "secure": true,
        "secure_prefix": false
      }
    ],
    "truncated": false
  },
  "cross_origin": {
    "embedder_policy": null,
    "opener_policy": null,
    "resource_policy": null
  },
  "csp": {
    "directives": [
      "base-uri",
      "child-src",
      "connect-src",
      "default-src",
      "font-src",
      "form-action",
      "frame-ancestors",
      "frame-src",
      "img-src",
      "manifest-src",
      "media-src",
      "script-src",
      "style-src",
      "upgrade-insecure-requests",
      "worker-src"
    ],
    "frame_ancestors": "'none'",
    "missing_directives": [],
    "object_src_restricted": true,
    "policies": 1,
    "present": true,
    "report_only": false,
    "scripts_restricted": true,
    "unsafe_eval": false,
    "unsafe_inline": false,
    "value": "default-src 'none'; base-uri 'self'; child-src github.githubassets.com ...",
    "wildcard_sources": false
  },
  "deductions": [
    {
      "code": "permissions_policy_missing",
      "points": 5,
      "reason": "no Permissions-Policy header"
    },
    {
      "code": "cookie_not_httponly",
      "points": 5,
      "reason": "1 cookie(s) without HttpOnly (fine only if scripts must read them)"
    }
  ],
  "disclosure": {
    "server": "github.com",
    "x_aspnet_version": null,
    "x_powered_by": null
  },
  "final_url": "https://github.com",
  "grade": "A",
  "hsts": {
    "include_subdomains": true,
    "max_age": 31536000,
    "preload": true,
    "preload_eligible": true,
    "present": true,
    "valid": true,
    "value": "max-age=31536000; includeSubdomains; preload"
  },
  "https": true,
  "note": "one response's headers only; pages, APIs and error responses of the same site can differ",
  "permissions_policy": {
    "present": false,
    "value": null
  },
  "redirects": [],
  "referrer_policy": {
    "effective": "strict-origin-when-cross-origin",
    "note": null,
    "value": "origin-when-cross-origin, strict-origin-when-cross-origin"
  },
  "score": 90,
  "status": 200,
  "untrusted_content": true,
  "upgraded_to_https": false,
  "url": "https://github.com",
  "x_content_type_options": {
    "valid": true,
    "value": "nosniff"
  },
  "x_frame_options": {
    "valid": true,
    "value": "DENY"
  }
}

Security scan

• No findings. We scan names, descriptions and tool definitions for hidden instructions and other prompt-injection patterns.

Recent checks