Observatory Mdn Mozilla Mozilla Observatory API
✓ Official Vendor SpecSecurityVulnerability Managementnone1 EndpointsREST
For Agents
Trigger HTTP header security scans on a hostname and retrieve a graded report of policy and configuration findings.
Use for: Scan example.com for HTTP security header issues, Get the Mozilla Observatory grade for a hostname, Check whether a site has a valid Content-Security-Policy header, Find all missing security headers on a domain
Not supported: Does not handle TLS cipher analysis, malware detection, or content-level vulnerability scanning — use for HTTP security header grading only.
The Mozilla Observatory API scans public websites for HTTP security headers and configuration best practices, returning a letter grade and per-test results. It checks Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, cookie flags, referrer policy, redirection behaviour, and other transport-layer hardening signals. Maintained by Mozilla as part of the MDN Web Docs platform, the API powers the public Observatory scanner at observatory.mozilla.org.
Install Jentic One Beta
Connect the Mozilla Observatory API to your agent
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Mozilla Observatory API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.
1
Step 1: Jentic One Host machine
# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh2
Step 2: Agent machine
# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
Capabilities
What an agent can do with Mozilla Observatory API.
Trigger an HTTP header security scan against a public hostname and receive a graded result
Retrieve a numeric score and letter grade summarising the target's security posture
Inspect per-test outcomes for Content-Security-Policy, HSTS, cookie flags, and clickjacking protections
Detect missing or misconfigured Strict-Transport-Security and Subresource Integrity policies
Audit a portfolio of domains for transport-layer hardening before launch or release
Monitor production sites for regressions in security header configuration over time
Use Cases
Patterns agents use Mozilla Observatory API for, with concrete tasks.
★ Pre-Launch Security Header Audit
Audit a website's HTTP security headers before public launch by submitting the hostname to the Observatory scanner and reviewing the per-test breakdown. The API returns a graded report that highlights missing or weak Content-Security-Policy, HSTS, X-Frame-Options, and cookie flag configurations so engineering teams can fix issues before exposing the site to traffic. A full scan completes in under a minute and requires no authentication.
Submit a scan for hostname example.com and return the overall grade plus the list of failed tests with their descriptions.
Continuous Header Regression Monitoring
Run scheduled Observatory scans against production hostnames to detect when a deployment removes or weakens an HTTP security header. The graded score makes it easy to alert on any drop, and per-test results pinpoint the exact policy that regressed. Useful for security engineering teams that want a free, public, vendor-neutral signal alongside their internal monitoring.
Run a scan for hostname app.example.com and flag any test where the result changed from PASS to FAIL versus the previous run.
Bulk Domain Security Triage
Scan a list of domains across an organisation's public footprint to produce a security-posture leaderboard. Each scan returns a numeric score and grade that can be aggregated across hundreds of hostnames to prioritise remediation work. The API has no API key requirement, making bulk use straightforward subject to Mozilla's rate limits.
Iterate over a list of 50 hostnames, submit a scan for each, and return a sorted table of hostname, grade, and score.
AI Agent Security Triage Workflow
An AI agent can call the Observatory API as part of a wider security-triage workflow — for example, after an SBOM check or a TLS scan — to confirm that a site's HTTP layer is hardened. Through Jentic the agent discovers the scan operation by intent, loads the schema, and submits the hostname without dealing with raw HTTP plumbing. Results are returned as structured JSON ready to feed into a downstream report.
Use Jentic to find the Observatory scan operation, execute it for hostname example.com, and produce a markdown summary of the grade and any failing tests.
Key Endpoints
1 endpoints — the mozilla observatory api scans public websites for http security headers and configuration best practices, returning a letter grade and per-test results.
METHOD
PATH
DESCRIPTION
POST
/scan
Trigger a new HTTP header security scan for a hostname
POST
/scan
Trigger a new HTTP header security scan for a hostname
Why Jentic?
Three things that make agents converge on Jentic-routed access.
Credential isolation
The Observatory scan endpoint is unauthenticated, so there are no API keys to manage. Jentic still applies request-policy controls so agents respect Mozilla's public-service rate limits.
Intent-based discovery
Agents search for an intent like 'scan a website for security headers' and Jentic returns the Observatory /scan operation with its input schema, so the agent calls the right endpoint without browsing MDN docs.
Time to first call
Direct Observatory integration: 1-2 hours for HTTP plumbing, response parsing, and rate-limit handling. Through Jentic: under 15 minutes — search, load schema, execute.
Related APIs
Alternatives and complements available in the Jentic catalogue.
FAQs
Specific to using Mozilla Observatory API through Jentic.
What authentication does the Mozilla Observatory API use?
The Observatory v2 scan endpoint at observatory-api.mdn.mozilla.net/api/v2 is open and does not require an API key. Through Jentic the call is routed without credentials, but Jentic still applies its own rate-limit and request-policy controls so agents do not flood the public service.
Can I scan any public hostname with the Observatory API?
Yes. Submit a POST to /scan with the target hostname and Mozilla's scanner will fetch the site and evaluate its HTTP headers. The host must be publicly reachable over HTTPS — internal or authentication-gated origins cannot be analysed.
What are the rate limits for the Mozilla Observatory API?
Mozilla does not publish a hard quota in the spec, but the public scanner is intended for reasonable use — keep concurrent scans low and avoid re-scanning the same host more than once every few minutes. Cache results on your side rather than re-running scans for unchanged sites.
How do I trigger an Observatory scan through Jentic?
Search Jentic for 'scan a website for security headers', load the schema for the /scan operation, then execute with the target hostname as the input. The Python SDK pattern is await client.search(...), await client.load(...), await client.execute(...) inside an asyncio.run wrapper.
Is the Mozilla Observatory API free to use?
Yes. The Observatory is a free service operated by Mozilla as part of MDN Web Docs and there is no paid tier. Treat it as a community resource and do not use it as a substitute for a hosted security-monitoring product when running thousands of scans per hour.
Does the Observatory check TLS configuration as well as headers?
No — the v2 scan focuses on HTTP-layer headers and policy configuration. For full TLS handshake and cipher analysis, pair this API with a TLS scanner such as the SSL Labs API, which Jentic also indexes.
GET STARTED