{"id":"csp-audit","title":"Content-Security-Policy audit","description":"Parses a Content-Security-Policy header or <meta> value and reports every clause that weakens it: 'unsafe-inline' without nonces or hashes, 'unsafe-eval', wildcard hosts, data:/blob: in script-src, scheme-only https:, duplicate directives (second is discarded), missing base-uri or object-src 'none', open frame-ancestors or form-action, and the strict-dynamic cases that silently ignore host sources. Returns an overall strength score and the effective source list each sensitive directive resolves to after default-src fallback. No fetches — the policy text is the input.","roi":"A copy-pasted CSP that still has 'unsafe-inline' is the single most common XSS post-mortem root cause; this flags it before deploy.","audience":"developer","package":"infra-preflight-kit","channels":["x402","mcp"],"endpoint":{"method":"POST","url":"https://agents.writerslogic.com/api/v1/csp-audit","path":"/api/v1/csp-audit","contentType":"application/json"},"price":{"amount":"0.005","currency":"USDC","network":"base","perCall":true,"failedCallsCharged":false},"inputSchema":{"type":"object","additionalProperties":false,"required":["policy"],"properties":{"policy":{"type":"string","maxLength":8000,"description":"The full Content-Security-Policy value (not the header line)."},"deployTarget":{"type":"string","enum":["report-only","enforce"],"description":"Reserved for future harsher checks in enforce mode."}}},"resultSchema":{"type":"object","properties":{"status":{"type":"string","enum":["pass","fail","unknown","unsupported"],"description":"pass: every rule held. fail: a rule was violated (see witnesses). unknown: the input lacks the evidence to decide. unsupported: outside what this engine covers. Missing evidence is never a pass."},"policy":{"type":"string"},"directiveCount":{"type":"integer"},"findings":{"type":"array","items":{"type":"object","properties":{"directive":{"type":"string"},"ruleId":{"type":"string"},"severity":{"type":"string","enum":["critical","high","medium","low"]},"detail":{"type":"string"}}}},"strength":{"type":"string","enum":["strong","moderate","weak"]},"strictDynamic":{"type":"boolean"},"effective":{"type":"object","description":"For each sensitive directive, the resolved source list after default-src/script-src fallback."},"trustedTypes":{"type":"object","description":"Trusted Types enforcement: whether require-trusted-types-for 'script' is set, and the trusted-types policy name list."},"witnesses":{"type":"array","items":{"type":"object","properties":{"ruleId":{"type":"string"},"detail":{"type":"string"},"path":{"type":"string","description":"JSON pointer or dotted path into the input."},"offset":{"type":"integer"},"index":{"type":"integer"},"expected":{"description":"What the rule required."},"actual":{"description":"What the input had."}}}},"versions":{"type":"object","description":"Every semantic dependency of this answer (engine, tables and their as-of dates, tokenizer, calendar, rounding profile)."},"limits":{"type":"array","items":{"type":"string"}},"deterministic":{"type":"boolean","description":"Always true: pure code, no model."}}},"outputSchema":{"type":"object","properties":{"data":{"type":"object","properties":{"status":{"type":"string","enum":["pass","fail","unknown","unsupported"],"description":"pass: every rule held. fail: a rule was violated (see witnesses). unknown: the input lacks the evidence to decide. unsupported: outside what this engine covers. Missing evidence is never a pass."},"policy":{"type":"string"},"directiveCount":{"type":"integer"},"findings":{"type":"array","items":{"type":"object","properties":{"directive":{"type":"string"},"ruleId":{"type":"string"},"severity":{"type":"string","enum":["critical","high","medium","low"]},"detail":{"type":"string"}}}},"strength":{"type":"string","enum":["strong","moderate","weak"]},"strictDynamic":{"type":"boolean"},"effective":{"type":"object","description":"For each sensitive directive, the resolved source list after default-src/script-src fallback."},"trustedTypes":{"type":"object","description":"Trusted Types enforcement: whether require-trusted-types-for 'script' is set, and the trusted-types policy name list."},"witnesses":{"type":"array","items":{"type":"object","properties":{"ruleId":{"type":"string"},"detail":{"type":"string"},"path":{"type":"string","description":"JSON pointer or dotted path into the input."},"offset":{"type":"integer"},"index":{"type":"integer"},"expected":{"description":"What the rule required."},"actual":{"description":"What the input had."}}}},"versions":{"type":"object","description":"Every semantic dependency of this answer (engine, tables and their as-of dates, tokenizer, calendar, rounding profile)."},"limits":{"type":"array","items":{"type":"string"}},"deterministic":{"type":"boolean","description":"Always true: pure code, no model."}}},"_provenance":{"type":"object","description":"C2PA-aligned manifest and W3C VC 2.0 (eddsa-jcs-2022) issued by the hub DID; verify at POST /api/v1/verify-provenance"}},"required":["data","_provenance"]},"example":{"policy":"default-src 'self'; script-src 'self' 'unsafe-inline' https:; object-src 'none'; base-uri 'self'"},"openapiOperation":{"operationId":"csp_audit","summary":"Content-Security-Policy audit","description":"Parses a Content-Security-Policy header or <meta> value and reports every clause that weakens it: 'unsafe-inline' without nonces or hashes, 'unsafe-eval', wildcard hosts, data:/blob: in script-src, scheme-only https:, duplicate directives (second is discarded), missing base-uri or object-src 'none', open frame-ancestors or form-action, and the strict-dynamic cases that silently ignore host sources. Returns an overall strength score and the effective source list each sensitive directive resolves to after default-src fallback. No fetches — the policy text is the input.\n\nPrice: 0.005 USDC on Base (x402).","x-x402-price-usdc":"0.005","x-x402-amount":"5000","x-payment-info":{"protocols":["x402"],"price":{"mode":"fixed","currency":"USD","amount":"0.005"}},"x-audience":"developer","x-sample-url":"https://agents.writerslogic.com/api/v1/samples/csp-audit","security":[{"x402":[]},{"apiKey":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","additionalProperties":false,"required":["policy"],"properties":{"policy":{"type":"string","maxLength":8000,"description":"The full Content-Security-Policy value (not the header line)."},"deployTarget":{"type":"string","enum":["report-only","enforce"],"description":"Reserved for future harsher checks in enforce mode."}}},"example":{"policy":"default-src 'self'; script-src 'self' 'unsafe-inline' https:; object-src 'none'; base-uri 'self'"}}}},"responses":{"200":{"description":"Paid result with provenance","content":{"application/json":{"schema":{"type":"object","properties":{"data":{"type":"object","properties":{"status":{"type":"string","enum":["pass","fail","unknown","unsupported"],"description":"pass: every rule held. fail: a rule was violated (see witnesses). unknown: the input lacks the evidence to decide. unsupported: outside what this engine covers. Missing evidence is never a pass."},"policy":{"type":"string"},"directiveCount":{"type":"integer"},"findings":{"type":"array","items":{"type":"object","properties":{"directive":{"type":"string"},"ruleId":{"type":"string"},"severity":{"type":"string","enum":["critical","high","medium","low"]},"detail":{"type":"string"}}}},"strength":{"type":"string","enum":["strong","moderate","weak"]},"strictDynamic":{"type":"boolean"},"effective":{"type":"object","description":"For each sensitive directive, the resolved source list after default-src/script-src fallback."},"trustedTypes":{"type":"object","description":"Trusted Types enforcement: whether require-trusted-types-for 'script' is set, and the trusted-types policy name list."},"witnesses":{"type":"array","items":{"type":"object","properties":{"ruleId":{"type":"string"},"detail":{"type":"string"},"path":{"type":"string","description":"JSON pointer or dotted path into the input."},"offset":{"type":"integer"},"index":{"type":"integer"},"expected":{"description":"What the rule required."},"actual":{"description":"What the input had."}}}},"versions":{"type":"object","description":"Every semantic dependency of this answer (engine, tables and their as-of dates, tokenizer, calendar, rounding profile)."},"limits":{"type":"array","items":{"type":"string"}},"deterministic":{"type":"boolean","description":"Always true: pure code, no model."}}},"_provenance":{"type":"object","description":"C2PA-aligned manifest and W3C VC 2.0 (eddsa-jcs-2022) issued by the hub DID; verify at POST /api/v1/verify-provenance"}},"required":["data","_provenance"]}}}},"400":{"description":"Invalid request (no payment consumed)","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"},"code":{"type":"string"}}}}}},"401":{"description":"Invalid X-API-KEY","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"},"code":{"type":"string"}}}}}},"402":{"description":"Payment required or invalid","content":{"application/json":{"schema":{"type":"object","description":"x402 v2 PaymentRequired (also base64 in the PAYMENT-REQUIRED header)","properties":{"x402Version":{"type":"integer"},"error":{"type":"string"},"code":{"type":"string"},"resource":{"type":"object"},"accepts":{"type":"array","items":{"type":"object"}},"extensions":{"type":"object"}}}}}},"502":{"description":"Upstream failure; the payment is released or not settled","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"},"code":{"type":"string"}}}}}}}},"links":{"docs":"https://agents.writerslogic.com/docs/csp-audit/","docsJson":"https://agents.writerslogic.com/docs/csp-audit.json","sample":"https://agents.writerslogic.com/api/v1/samples/csp-audit","openapi":"https://agents.writerslogic.com/openapi.json","catalog":"https://agents.writerslogic.com/api/v1/catalog","verifyProvenance":"https://agents.writerslogic.com/api/v1/verify-provenance","index":"https://agents.writerslogic.com/docs/index.json"}}