CORS checker
Works in Postman, fails in the browser. Border sends the same preflight your browser sends, applies the CORS rules the way Chrome does, and tells you which header is wrong and exactly what to send instead.
Names are enough for Authorization and API keys. Values are never sent.
Paste the status line and headers from curl -i or the DevTools Network tab. Press Check once to get the curl commands for your request.
Whether the call needs a preflight and why, then Access-Control-Allow-Origin (one value, exact origin, no trailing slash, never * with cookies), Allow-Credentials, the 2xx status, methods (case-sensitive) and headers (Authorization is not covered by *). Verdicts and messages matched Chrome 156 on 56 test cases.
The exact preflight and response headers for your origin, method, headers and cookies, plus the usual causes: auth middleware rejecting OPTIONS, a redirect on the preflight, the header added twice by app and proxy, a third-party API that needs a backend call.
Border sends the OPTIONS preflight and only sends GET and HEAD for real. It never sends your key or cookie values. For localhost and staging servers, paste the curl output. It also flags a server that trusts any website with cookies.
Add the MCP server https://border.clawhard.com/mcp (tools border_check_cors for live APIs and border_check_cors_headers for pasted curl output) or call the JSON API described at /openapi.json. Instead of guessing at middleware settings, the agent sees the real preflight, Chrome's exact error and the headers to send, fixes the server, and checks again.
Add Border to ChatGPT, Claude, Cursor or any assistant that supports MCP, then ask it to find out why the browser blocks a cross-origin API call (CORS), with Chrome's exact error and the response headers that fix it. No key, no login.
https://border.clawhard.com/mcpclaude mcp add --transport http clawhard-border https://border.clawhard.com/mcp
Press Add to Claude, or open Customize → Connectors → Add custom connector, paste the URL and leave sign-in empty.
Open Plugins → + → Add custom MCP server, paste the URL, choose No authentication, accept the warning, then Create as a plugin. Start a chat and type @ to use it.
codex mcp add clawhard-border --url https://border.clawhard.com/mcp
gemini mcp add --transport http clawhard-border https://border.clawhard.com/mcp
{
"mcpServers": {
"clawhard-border": { "url": "https://border.clawhard.com/mcp" }
}
}{
"servers": {
"clawhard-border": { "type": "http", "url": "https://border.clawhard.com/mcp" }
}
}No desktop app? Add to VS Code in the browser · VS Code Insiders · Add to Cursor in the browser
Other apps: Goose · LM Studio. Any MCP client works with the URL (Streamable HTTP, no headers).
OpenAPI (custom GPT Actions, scripts) · llms.txt · MCP server card · Agent card · All Clawhard tools in one connector
Border checks a cross-origin API call the way the browser does: it sends the real preflight to the live API (or reads pasted curl output for localhost), applies the Fetch standard CORS rules as Chrome implements them, and returns the verdict, Chrome's exact error message, the failing step and the exact response headers that fix it. No account.
Postman and curl do not enforce CORS; browsers do. The server answered, but the browser refuses to give the response to your page unless the server sends the right Access-Control-Allow-Origin (and, for preflighted requests, a matching answer to the OPTIONS preflight). Border sends the same preflight a browser sends and tells you which header is missing or wrong.
When the method is not GET, HEAD or POST, when Content-Type is anything other than text/plain, multipart/form-data or application/x-www-form-urlencoded (application/json needs one), or when the page sets any other header, such as Authorization or X-API-Key. The browser then sends OPTIONS first and only sends the real request if that answer allows it.
No. With credentials (fetch credentials: "include" or withCredentials: true) the server must name the exact origin, send Access-Control-Allow-Credentials: true, and list methods and headers by name; * is refused for the origin and read literally elsewhere.
Browsers never send cookies or the Authorization header on the OPTIONS preflight, so a server that checks login on every request rejects it, and a server without an OPTIONS route answers 404 or 405. Let OPTIONS through before the auth check and answer it with 204 and the CORS headers.
No. It makes the request opaque: the browser sends it but hides the response, so your code cannot read the status, headers or body. The fix is on the server (or calling the API from your own backend).
Yes. Add the MCP server https://border.clawhard.com/mcp (tools border_check_cors and border_check_cors_headers) or call the JSON API described at /openapi.json. It is also on the Clawhard MCP server at https://mcp.clawhard.com/mcp.
For AI assistants and developers: llms.txt · API (OpenAPI) · MCP server · sitemap