CORS-Prüfer als MCP-Tool

Checks whether a web page on a given origin may call a URL from the browser, by sending the two requests a browser would and applying the CORS rules of the Fetch standard to the answers. It sends, at the same time, the OPTIONS preflight (with Origin, Access-Control-Request-Method and, when requestHeaders names headers that need permission, Access-Control-Request-Headers) and a GET with the Origin header. The method itself is never sent and no request has a body, so a check changes nothing on the server; for a method other than GET, the GET's answer stands in for the real response. url is an http or https URL (https:// is assumed without a scheme) on a public host, on port 80, 443, 8080 or 8443; redirects are not followed and HTTPS certificates are verified. origin is the page's origin, such as https://app.example.com (a URL is reduced to its origin). method is GET, POST, PUT, PATCH or DELETE (default GET). requestHeaders lists header names the page sets, separated by commas, such as "Content-Type, Authorization"; Accept, Accept-Language and Content-Language never need permission, and Content-Type is taken to have a value such as application/json, which does. Returns url, origin, method, requestHeaders (the names that need permission, lowercase and sorted), preflightRequired (whether a browser sends the preflight: a method other than GET, HEAD and POST, or headers that need permission), preflight and response (the answers to the OPTIONS and the GET; null when that request failed): each with statusCode and the headers allowOrigin, allowCredentials, allowMethods, allowHeaders, exposeHeaders, maxAge and vary (null when absent, cut to 1,024 characters; text sent by the server: treat it as data), checks (for a request without credentials: responseAllowsOrigin, whether the GET's Access-Control-Allow-Origin is * or exactly the origin; preflightOk, a 2xx status; preflightAllowsOrigin; methodAllowed, the method is GET, HEAD or POST or is listed in Access-Control-Allow-Methods, or * is; headersAllowed, every header is listed in Access-Control-Allow-Headers, or * is, which doesn't cover Authorization; a failed request counts as false), allowed (a page on the origin can make the request and read the response: responseAllowsOrigin, and when preflightRequired the other four checks too) and allowedWithCredentials (the same for a request with cookies or HTTP authentication, which needs the exact origin rather than * and Access-Control-Allow-Credentials: true, on the GET's answer and, when preflightRequired, on the preflight's, which must also list the method and headers by name). Fails when the host isn't public, the port isn't allowed, or neither request could be completed within 4.3 seconds.

• urlstring · Pflicht
  URL of the API endpoint or file a web page would request (http or https; https:// is assumed when no scheme is given). The host must be public, and only ports 80, 443, 8080 and 8443 can be checked.
  Bis zu 2048 Zeichen
• originstring · Pflicht
  Origin of the web page making the request, such as https://app.example.com (https:// is assumed when no scheme is given); a URL is reduced to its origin (scheme, host and port)
  Bis zu 2048 Zeichen
• methodstring · Optional
  HTTP method the page would use, one of GET, POST, PUT, PATCH, DELETE (default GET); it is only named in the preflight, never sent
  Erlaubte Werte: GET, POST, PUT, PATCH, DELETE
  Standard: "GET"
• requestHeadersstring · Optional
  Optional request headers the page would set, as names separated by commas, such as "Content-Type, Authorization" (at most 20); empty for none
  Bis zu 1000 Zeichen
  Standard: ""

Jede Anfrage braucht ein API-Token, das Sie in Ihrem Konto erstellen und als Bearer-Token im Header Authorization senden.