securityv0.2.1free
fizzgig__cors_audit
inspects api routes for permissive cors configs.
// ai does this over time
the AI sets CORS to wildcard because something didn't work and the error went away. ships to production. now anyone's javascript can hit your API.
// the tool does
6 checks: wildcard origin, wildcard origin + credentials:true (browser blocks but intent reveals the architectural flaw), reflective origin echoing, permissive method allowlists, permissive header allowlists, preflight cache discipline.
// so you can
don't ship the wildcard. the 6 patterns above account for almost every CORS misconfig the AI introduces.
● live● v0.2.1● free
// input schema
{
"type": "object"
"required": [
"project"
]
"properties": {
"project": {
"type": "string"
"description": "the project slug or path"
}
"strict": {
"type": "boolean"
"default": false
"description": "fail on warnings, not just errors"
}
}
}
// output schema
{
"type": "object"
"properties": {
"ok": {
"type": "boolean"
}
"findings": {
"type": "array"
"items": {
"type": "object"
"properties": {
"severity": {
"enum": [
"info"
"warn"
"high"
"critical"
]
}
"message": {
"type": "string"
}
"fix": {
"type": "string"
}
}
}
}
}
}
// example call from cursor
→ fizzgig__cors_audit(project="myapp")
{
"ok": false,
"findings": [
{ "severity": "high",
"message": "policy uses user_id without auth.uid()",
"fix": "USING (auth.uid() = user_id)" }
],
"scanned": 3, "duration_ms": 142
}
// reviews
@maya.codes★★★★★
2 days agocaught a policy that would have leaked every user's comments. shipped a fix in 4 minutes.
@solo_at_3am★★★★★
1 week agofirst tool i installed. it's the one that pays for itself.
@vibebuilder★★★★☆
2 weeks agoworks great. one false positive on a join table - easy to ignore.
// primary action
add to your editor
paste this into your mcp config.
{
"fizzgig": {
"url": "https://mcp.fizzgig.ai",
"tools": ["cors_audit"]
}
}// pricing
free
unlimited calls on the free tier.