01
Response headers
Six checks on what the server sends, before a byte of HTML is parsed. Presence alone does not pass — an HSTS header with max-age=0 fails, and X-Content-Type-Options only counts if it actually says nosniff.
A REPORT CARD FOR ANY URL
Everypagegetsagrade.
Rubric reads the response headers, then opens the page in a real browser at the edge. Thirteen checks, two categories, a score for each. No account, no config.
13
CHECKS, EACH INDEPENDENTLY WEIGHTED
2
PASSES · HEADERS, THEN A REAL BROWSER
0
SIGNUP, CONFIG, OR API KEY
A–F
GRADED PER CATEGORY, NOT ONE NUMBER
RUN AN AUDIT
Point it at a URL.
OR TRY
Nothing is stored and no account is involved. Each run fetches the response headers, then opens the page in a browser sandbox at the edge — about six seconds.
THE PLATFORM
Two passes over the page.
The first pass is a plain request — any serverless function could do it. The second needs a browser, which is why this runs as an agent rather than a function.
02
The rendered page
Seven checks a fetch cannot make, because they only exist once the browser has built the document. A real browser opens the page in the sandbox and reports what it found there.
03
Scoring
Each check carries its own weight, and each category scores on its own. A site with immaculate headers and a broken page cannot hide behind a single average.
One request, no key.
The same endpoint the form above calls. The one header that is not obvious is required by the agent runtime itself — leave it out and you get a 400 before the handler ever runs.
curl
curl -sS \
'https://edgeone-site-auditor.edgeone.dev/audit?url=https://example.com' \
-H 'makers-conversation-id: your-session-id'
PROOF
Check it yourself.
SOURCERead the codeThe scoring and the URL guard are pure functions with 12 tests that run without EdgeOne. Nothing about the grade is hidden.OPEN THE REPOSAFETYWhat it refuses to fetchThe agent fetches whatever it is handed, from inside a cloud network. Loopback, private ranges, CGNAT and cloud metadata endpoints are blocked before the request is made.SEE THE GUARDRUNTIMEWhy it is an agentThe browser pass needs context.sandbox, which EdgeOne injects into agents only — an ordinary serverless function never receives it.SEE THE HANDLER
No account, no config, no API key