csp-audit
Content-Security-Policy audit — Parses a Content-Security-Policy header or value and reports every clause that weakens it: 'unsafe-inline' without nonces or hashes, 'unsafe-eval', wildcard hosts, data:/blob: in script-src, scheme-only https:, duplicate directives (second is discarded), missing base-uri or object-src 'none', open frame-ancestors or form-action, and the strict-dynamic cases that silently ignore host sources
Tool call template
Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.
{
"id": 1,
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"arguments": {
"policy": "<policy>"
},
"name": "csp-audit"
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| policy | Yes | The full Content-Security-Policy value (not the header line). | |
| deployTarget | No | Reserved for future harsher checks in enforce mode. |