CLI

HTTP response debugger. CORS, CSP, security headers, redirects, cache — runs entirely on your machine.

MIT Go Local-first

🔒 Privacy: By default, this CLI never contacts xhttp.lol servers. All analysis runs directly from your machine to the target domain. The --api flag optionally routes requests through xhttp.lol for comparison. You can always self-host if you need privacy.

Install

    # Homebrew

    $ brew install yokedotlol/tap/xhttp

    # Or one-liner

    $ curl -sSL https://xhttp.lol/install.sh | bash

    # Or download from GitHub Releases

    $ curl -sL https://github.com/yokedotlol/xhttp/releases/latest/download/xhttp_darwin_arm64.tar.gz | tar xz

    $ sudo mv xhttp /usr/local/bin/

Quick Start

    # Full scan

    $ xhttp example.com

    # JSON output (default when piped)

    $ xhttp example.com --json | jq

    # CORS only

    $ xhttp cors example.com

    # Security headers

    $ xhttp headers example.com

    # CSP analysis

    $ xhttp csp example.com

    # Redirect chain

    $ xhttp chain example.com

    # Cache behavior

    $ xhttp cache example.com

    # Decode a CORS error from your browser console

    $ xhttp error "No 'Access-Control-Allow-Origin' header is present..."

    # Simulate a CORS request

    $ xhttp simulate https://api.example.com --origin https://app.example.com

Commands

`xhttp <domain>`	Full scan (headers, CSP, CORS, redirects, cache, TLS)
`xhttp cors <domain>`	CORS-focused scan with origin reflection detection
`xhttp headers <domain>`	Security headers scan and grading
`xhttp csp <domain>`	CSP parsing, bypass detection, grading
`xhttp chain <domain>`	Redirect chain with per-hop timing
`xhttp cache <domain>`	Cache-Control, CDN detection, TTL
`xhttp error <msg>`	Decode a browser CORS error → diagnosis + fix
`xhttp simulate <url>`	Simulate CORS with custom origin/method/headers

Flags

`--json`	Output raw JSON
`--api`	Route requests through xhttp.lol API instead of local analysis

Exit Codes

`0`	Scan succeeded, no critical issues
`1`	Scan succeeded, warnings found
`2`	Critical/high severity issues or usage error

Source

github.com/yokedotlol/xhttp — MIT licensed.

API

Prefer curl? The web API returns the same data — no CLI required:

$ curl -s xhttp.lol/example.com | jq

The API runs analysis server-side. Rate limited to 60 requests/hour. Full API docs →