redirect-credential-check
Redirect chain credential-leak check — Walks a supplied HTTP redirect chain (up to 25 hops of status + Location) for an agent or HTTP client author and reports, per hop, which of the request's header names (Authorization, Cookie, Proxy-Authorization, API-key-like, Referer) are stripped or still forwarded, the method after the hop (301/302 POST to GET, 303, 307/308), whether the hop crosses origin, scheme, or registrable domain, an http
Tool call template
Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.
{
"id": 1,
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"arguments": {
"requestUrl": "<requestUrl>",
"requestHeaderNames": "<requestHeaderNames>",
"hops": "<hops>"
},
"name": "redirect-credential-check"
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| hops | Yes | ||
| method | No | Initial request method. Default GET. | |
| requestUrl | Yes | Initial absolute URL. | |
| publicSuffixes | No | Extra public suffixes for registrable-domain decisions. | |
| requestHeaderNames | Yes | Names of headers on the initial request. Never send values. | |
| clientStripsOnCrossOrigin | No | Header names your client deletes on an origin change. Default: ["authorization"], the Fetch Standard rule. |