Evaluate captured HTTP response header fields against a declared policy and its route exceptions, and explain what is missing and what contradicts itself — entirely offline.
This walkthrough uses the tool's public README and checked-in example files. Run the command from a repository checkout with Node.js 22+.
Run the checked-in example
node bin/http-security-header-auditor.mjs --root examples/clean --as-of 2026-03-01Read the result
Exit 2 has two shapes on purpose. A configuration error means the run never had a subject, so there is nothing to report about. An unreadable input means the run had a subject and failed to obtain evidence about it — which is what incomplete exists to say, and a consumer needs the report to know which input was not read. Unknown evidence is never a pass.
Scope
Why a route has no URL. The capture schema has no url, host, origin or endpoint key, and an unknown key is refused rather than ignored. That is the structural half of "nothing is ever fetched": a tool whose input has no address in it cannot resolve one by accident, and a future change that wanted to would have to add the field first, in public, in a schema version bump.