CORS Policy Checker

Fetch a URL with a probe Origin and report Access-Control-Allow-* gaps, wildcards, and Origin reflection.

Free · API · MCPToolYour platform

Use CORS Policy Checker three ways

The free CORS Policy Checker on this page works in your browser. The same workflow is available via REST API for apps and via MCP for Cursor, Claude, and other agents — one API key, one plan, one quota. This tool is part of the security-apis module under Security Tools.

Free in browserUse CORS Policy Checker here — no account required.
REST APICall from your server with X-Api-Key.
MCP for agentsConnect Cursor or Claude to ToolYour MCP with the same key.

1. Get an API keySign in and open Dashboard → API Keys (works for REST and MCP).
2. Call or connectUse the REST API from your server, or paste the MCP URL into your agent config.
3. Same qualityOutput matches the free web tool across all three surfaces.

Manage API keys MCP setup API reference Create free account

What is CORS Policy Checker?

ToolYour CORS Policy Checker sends a GET with a probe Origin and scores Access-Control-Allow-Origin, Credentials, Headers, and Methods. Flags wildcard ACAO, dangerous * + credentials, and Origin reflection. Single-response check — full preflight may need OPTIONS on your API path. REST/MCP: /api/v1/security-apis/cors-policy-checker.

What are common questions about CORS Policy Checker?

What does CORS Policy Checker do?

Fetch a URL with a probe Origin and report Access-Control-Allow-* gaps, wildcards, and Origin reflection.

Is this available via API and MCP?

Yes. Same route under /api/v1/security-apis/{slug} with one ToolYour API key and shared credits.

What are the key features of CORS Policy Checker?

Browser + API

Run in the browser or via REST/MCP.

Structured report

JSON-friendly output for agents and dashboards.

How do you use CORS Policy Checker?

Open the tool

Use the Security Tools category page.

Provide input

URL, domain, or pasted text as required.

Review findings

Fix high-severity items first.