Header Inspector parses raw HTTP response headers into a normalized map and produces an OWASP Security Scorecard. The scorecard grades HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy from A to F. A CORS analyzer parses Access-Control headers and flags the wildcard origin plus credentials combination, which the CORS specification forbids.

How to use

1. Get the headers — Copy the response headers from your browser's Network tab, from curl -I, or from your server logs.
2. Paste them in — One header per line in "Name: value" format. The HTTP/1.1 status line is ignored if included.
3. Toggle scorecard — Leave OWASP scorecard ON to grade the security posture. Turn off for parser-only mode.
4. Run — Click Inspect or press Ctrl+Enter. The overall grade, per-category cards, CORS report, and remediation checklist appear in the output.
5. Read the remediation checklist — Already ordered by impact — fix the F items first. Each entry is a concrete recommendation you can paste into a PR or runbook.

MCP / API

Call header_inspector directly from any MCP-compatible agent:

// MCP TypeScript SDK
const result = await client.callTool({
  name: "header_inspector",
  arguments: {
    "headersRaw": "...",
    "scorecard": false
  }
});

// curl
curl -X POST https://obfus.link/mcp \
  -H "Authorization: Bearer <SPT>" \
  -H "Content-Type: application/json" \
  -d '{"method":"tools/call","params":{"name":"header_inspector","arguments":{"headersRaw":"...","scorecard":false}}}'

Related tools

FAQ