All projects on Base matching “permissions”

Sends a real request to any URL you provide, attaches an Origin header, and reads back all six standard cross-origin permission headers the server returns. Tells you whether cross-origin requests are enabled at all, whether your specific origin is permitted, and shows every permission value exactly as the server sent it. Useful for finding why a browser is blocking a request, confirming a new depl

Fetch a site's robots.txt and evaluate crawl permissions: given a URL (plus optional extra paths) and a user-agent, return whether each path is allowed or disallowed, the rule that matched, the user-agent group, the crawl-delay and any declared sitemaps. Implements the Robots Exclusion Protocol (RFC 9309) with longest-match-wins, Allow-over-Disallow tie-breaking and * / $ wildcards.

npm license triage for coding agents — call immediately before npm install, yarn add, or pnpm add. Returns npm-declared license, SPDX id, and permissive-default compatible (yes | no | unknown) so the agent can proceed, swap package, or escalate. Not SBOM, not legal advice. Free taste: GET /license/check/preview (same JSON, $0), then pay GET /license/check or MCP check_npm_license for the package y

What are the symbol, name, decimals, contract address and issuer of this stablecoin on this chain? Cited stablecoin token facts from a prepared dataset (USDC, EURC, USDT, PYUSD, DAI on the chains /v1/chain covers, where a permissively licensed source lists them): symbol, name, decimals, contract address, chain, issuer, each with a source citation and license. Fields not established from a source a

Audit a URL's HTTP security headers over a single body-free (HEAD) request. Grades Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy, flags information-leak headers (Server, X-Powered-By), and returns the parsed values plus advisory warnings. Clean JSON for security and pentest automation.

Lint a GitHub Actions workflow: actions not pinned to a commit SHA, missing or write-all permissions, pull_request_target with PR head checkout, script injection via event fields in run, secrets on the command line, curl|bash, self-hosted runners, deprecated set-output.

Check a public website's security hygiene before your agent links to it, recommends it, or sends data to it. One URL in, deterministic JSON out: HTTPS and redirect chain, HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, security.txt, robots.txt, sitemap.xml, plus plain-language notes. Private, localhost and raw-IP targets are rejected; error responses are no

Run a bounded deterministic preflight scan for possible private keys, secret assignments, permissive CORS, debug mode, insecure HTTP, and invalid JSON. Not a comprehensive security audit.

Analyze operation-level risk inside consolidated MCP tools. Returns evidence-backed ALLOW, DENY, or REQUIRE_APPROVAL decisions, retry semantics, schema-drift status, and a deterministic operation effect ID. Designed for MCP tools whose command/action arguments expose operations with different risk levels.