Csp Generate API

POST https://api.findutils.com/api/tools/csp-generate/execute

Build a Content-Security-Policy header from a preset (strict, typical, google-analytics) and/or your own directives, and get the header line, an equivalent <meta http-equiv> tag, and warnings such as script-src allowing 'unsafe-inline', 'unsafe-eval', * or data:, a missing object-src 'none', base-uri or frame-ancestors. Bare keywords like self are quoted for you; invalid sources are rejected with the directive named. Supports Report-Only with a report-uri. Pure computation: it checks the policy text, not a live site.

Open the tool Try it

Request body

application/json

preset

string optional

Starting policy: "strict", "typical" or "google-analytics". Your directives replace the preset's for the same directive. One of strict · typical · google-analytics.
directives

object optional

Directive name → list of sources (or a space-separated string), e.g. {"script-src": ["self", "https://cdn.example.com"]}. An empty list removes that directive.
upgrade_insecure_requests

boolean optional

Add upgrade-insecure-requests. Default: true. Default true.
report_only

boolean optional

Emit Content-Security-Policy-Report-Only instead (reports, does not block). Default: false. Default false.
report_uri

string optional

Where browsers send violation reports (report-uri).

Example arguments

Verified

{
  "preset": "typical",
  "directives": {
    "script-src": [
      "self",
      "https://cdn.example.com"
    ]
  }
}

curl -X POST https://api.findutils.com/api/tools/csp-generate/execute \
  -H "Content-Type: application/json" \
  -d '{
    "preset": "typical",
    "directives": {
      "script-src": [
        "self",
        "https://cdn.example.com"
      ]
    }
  }'

const response = await fetch('https://api.findutils.com/api/tools/csp-generate/execute', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({"preset":"typical","directives":{"script-src":["self","https://cdn.example.com"]}}),
});
const data = await response.json();

import requests

response = requests.post(
    "https://api.findutils.com/api/tools/csp-generate/execute",
    json={"preset":"typical","directives":{"script-src":["self","https://cdn.example.com"]}},
)
data = response.json()

$ch = curl_init('https://api.findutils.com/api/tools/csp-generate/execute');
curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_HTTPHEADER => ['Content-Type: application/json'],
    CURLOPT_POSTFIELDS => '{"preset":"typical","directives":{"script-src":["self","https://cdn.example.com"]}}',
    CURLOPT_RETURNTRANSFER => true,
]);
$data = json_decode(curl_exec($ch), true);

Also an MCP tool

Call csp_generate from Claude, Cursor or any MCP client. Same arguments, same output.

https://mcp.findutils.com

MCP reference

Rate limit: 60 a minute, per IP
Auth: None
REST id: csp-generate
MCP name: csp_generate
Category: Security
Machine-readable: openapi.json · markdown.md

Request body

Example arguments

More Security tools

More to explore