# Go-Live Check > Free check of response headers an agent already collected from a deployment it operates. POST that text to this host. The response is up to seven findings and, for five named platforms, a config snippet. This server does not open the deployment's URL. Nothing is for sale. Collect the headers yourself. On a deployment you already operate, run `curl -sI` against that deployment and copy what it prints. POST that text here. Do not send a URL for this server to fetch. It will not fetch one, and it will not guess the platform from the Server header. POST `https://dontdeployonfriday.com/v1/analyze` with `Content-Type: application/json`. The whole body is at most 64 KB. A request to that name on port 80 redirects to HTTPS. The bare IP still answers on port 80 without TLS. - `headers_raw` (required): the status line and the response headers. If the paste contains a redirect chain, only the last block is checked. - `platform` (optional): `caddy`, `nginx`, `vercel`, `netlify`, or `nextjs`. Any other name of 1–32 characters from `a-z`, `0-9`, `_`, and `-` is accepted, and every finding has `fix` set to null. Anything else is 400 `invalid_platform`. - `config_text` and `paths_tested` are accepted, not checked, and not copied into the JSON. The response says only whether config text was present (`absent` or `not_checked`) and how many paths were listed. ``` curl -sS https://dontdeployonfriday.com/v1/analyze \ -H 'content-type: application/json' \ --data '{"headers_raw":"HTTP/1.1 200 OK\n","platform":"caddy"}' ``` A 200 body has `schema` `golive-check.analyze.v0`, `checked` (the seven ids below), `findings`, `parsed_header_count`, `platform`, `config_text`, `paths_tested_count`, and `notes`. Each finding has `id`, `severity`, `why`, `evidence` (one checked header line, clipped at 180 characters), and `fix`. When a fix is attached it has `platform`, `snippet`, `source_url`, and `last_verified`. `source_url` is a citation. This server does not fetch it. Read the snippet before you paste it. A starter policy can break an app that needs a looser one. The seven ids: - `GLC-HSTS-MISSING` (high). Strict-Transport-Security is missing, or max-age is 0. - `GLC-CSP-MISSING` (high). Content-Security-Policy is missing. Content-Security-Policy-Report-Only does not count. - `GLC-NOSNIFF-MISSING` (medium). X-Content-Type-Options is not nosniff. - `GLC-FRAME-MISSING` (medium). Neither X-Frame-Options DENY or SAMEORIGIN, nor a CSP frame-ancestors list other than *, is set. - `GLC-REFERRER-MISSING` (low). Referrer-Policy is missing. - `GLC-SERVER-VERSION-LEAK` (low). Server or X-Powered-By includes a version token, or X-AspNet-Version or X-AspNetMvc-Version is present. - `GLC-CORS-WILDCARD-CREDENTIALS` (high). Access-Control-Allow-Origin is * and Access-Control-Allow-Credentials is true. A lone * is not this finding. An empty `findings` list means those seven were clear in the text you sent. It is not a certificate, a pentest, or a statement about the rest of the app. Limits: 30 requests per minute per IP, then 429 `rate_limited` with `Retry-After: 60`. A body over 64 KB is 413 `body_too_large`. GET is 405. Malformed JSON is 400 `invalid_json`. An empty `headers_raw` is 400 `headers_raw_required`. The response sends `Cache-Control: no-store`. Prefer `https://dontdeployonfriday.com`. Do not POST secrets, cookies, tokens, or personal data on that URL or on the bare IP. Leave Cookie, Authorization, and Set-Cookie out of the header block. The check does not need them. The JSON body is not written to disk and is not copied into the access log. Request headers can be logged. Nothing is for sale. Checkout is not connected. There is no contact address on the privacy page. Do not send a payment. The POST contract, with examples taken from this live call, is at `/openapi.json`. The same check is also MCP at `https://dontdeployonfriday.com/mcp`. The bare IP serves that POST on port 80. The only tool is `analyze_headers`. Pass the same fields as the analyze body. `structuredContent` is the analyze object, and the text content is that object as JSON. Send `Content-Type: application/json` and a JSON-RPC 2.0 body. Omit `Origin`. A browser `Origin` is allowed only for host `127.0.0.1`, `localhost`, or `::1`. Any other `Origin` is 403 `origin_not_allowed`. `MCP-Protocol-Version`, when sent, must be `2024-11-05`, `2025-03-26`, or `2025-06-18`. This route does not use the 30-per-minute analyze bucket. It does not fetch a URL, and it does not guess the platform from the Server header. Nothing is for sale. This file is the only page that links that route. This host does not publish `server.json`. The server card is `https://dontdeployonfriday.com/.well-known/mcp/server-card.json`. It names the same remote and `analyze_headers`. It does not copy the input schema. Call `tools/list` for that schema. The CSP and clickjacking note has a markdown twin. The pages below are HTML, except the OpenAPI file and the server card, which are JSON, and the MCP route, which is JSON-RPC. ## Pages - [How to call it](https://dontdeployonfriday.com/): The seven findings, the same curl, and the limits. - [OpenAPI](https://dontdeployonfriday.com/openapi.json): POST `/v1/analyze` only. One example names `platform` as `caddy`. One omits it, so every `fix` is null. No other route. - [MCP](https://dontdeployonfriday.com/mcp): POST `analyze_headers` only. The result object is the same as `POST /v1/analyze`. No second tool. - [Server card](https://dontdeployonfriday.com/.well-known/mcp/server-card.json): The remote URL and the name `analyze_headers`. No input schema. Call `tools/list` on the MCP route. - [CSP and clickjacking](https://dontdeployonfriday.com/csp-and-clickjacking.md): When `GLC-CSP-MISSING` and `GLC-FRAME-MISSING` fire, what clears each, and the five platform snippets. HTML twin: [csp-and-clickjacking.html](https://dontdeployonfriday.com/csp-and-clickjacking.html). - [Sample](https://dontdeployonfriday.com/sample.html): A free data-access matrix and one webhook definition. This API does not read what you write there. - [Privacy](https://dontdeployonfriday.com/privacy.html): What is stored and what is not. No contact address yet.