Edge Telemetry Collector + Claude Remediation Pipeline

Automated web infrastructure diagnostics & AI-synthesized remediation.

Inspect live HTTP security posture, TLS handshakes, TTFB latency, and DOM asset origins via a single API call—then synthesize non-breaking Content-Security-Policy headers and server configs using structured LLM reasoning.

Launch Live Telemetry Sandbox Explore REST API & LLM Schema →

$curl -sX POST https://webdiagnostic-agency.com/api/v1/audit -H "Content-Type: application/json" -d '{"url":"example.com"}'

Interactive Product Sandbox

Test live telemetry collection & AI patch synthesis

Run an instant SSRF-guarded edge probe against any public hostname to inspect real response headers, extracted DOM script/style origins, raw JSON telemetry, and synthesized server configs.

Composite Health

68/100

HTTP 200 • Reachable

Edge TTFB Latency

84 ms

Origin: ECS / Edge

Perimeter Security

50%

3 missing OWASP headers

DOM Asset Origins

Parsed for non-breaking CSP

Detected Telemetry Findings example.com

MISSINGStrict-Transport-Security (HSTS) header not enforced; susceptible to protocol downgrade interception.
MISSINGContent-Security-Policy (CSP) absent; inline and cross-origin script execution unrestricted.
MISSINGX-Frame-Options / frame-ancestors directive missing; clickjacking surface exposed.
VERIFIEDViewport & Document Encoding valid for responsive rendering.

Extracted DOM Allowlist Context LLM Input

Before synthesizing a Content-Security-Policy, our parser extracts external script, stylesheet, font, and frame origins so the generated policy never breaks live assets:

{
  "script_origins": ["'self'"],
  "style_origins": ["'self'", "'unsafe-inline'"],
  "frame_origins": ["'none'"],
  "detected_stack": "standards-http-origin"
}

{
  "api_version": "2026.10",
  "target": "example.com",
  "reachable": true,
  "status_code": 200,
  "response_time_ms": 84,
  "overall_health_score": 68,
  "security_score": 50,
  "performance_score": 100,
  "seo_score": 55,
  "detected_origins": {
    "scripts": [],
    "styles": [],
    "frames": []
  },
  "issues": [
    "Missing Strict-Transport-Security (HSTS) header.",
    "Missing Content-Security-Policy (CSP) header.",
    "Missing X-Frame-Options / frame-ancestors protection."
  ]
}

Synthesized via WebDiagnostic Remediation Pipeline (Structured Tool Schema: synthesize_remediation_patch)

AST Policy Validated

# Synthesized Nginx & Edge Security Configuration for example.com
# Context: Preserves detected DOM origins while enforcing HSTS, anti-framing & strict CSP

add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; frame-ancestors 'self'; base-uri 'self'; form-action 'self';" always;

AI Engine Architecture

Why we pair deterministic edge probes with Anthropic Claude

Static security scanners flag missing headers, but deploying generic boilerplate Content-Security-Policy or caching rules breaks third-party scripts, payment frames, and web fonts. WebDiagnostic uses a three-stage hybrid pipeline to generate safe, stack-specific patches.

STAGE 01 • EDGE TELEMETRY COLLECTOR

Deterministic HTTP, TLS & DOM Origin Parsing

Distributed Cloudflare Workers execute bounded, SSRF-hardened probes to capture TTFB latency, compression codecs, TLS headers, and parse HTML AST tags (<script>, <link>, <iframe>) into normalized JSON telemetry.

STAGE 02 • CLAUDE MESSAGES API + TOOL USE

Context-Aware Policy Reasoning & Log Triage

Telemetry payloads and server stack fingerprints (Nginx, Apache, Cloudflare Workers, Next.js) are processed through Anthropic's Claude API using strict JSON schema tool definitions and prompt-cached OWASP / NIS2 compliance rulesets.

STAGE 03 • SYNTAX VERIFIER & CI/CD EXPORT

Deterministic Validation & Patch Delivery

Every synthesized header directive is verified against RFC grammar constraints before returning ready-to-merge config diffs via REST API, GitHub PR comments, or automated webhook alerts.

pipeline/claude_remediation_tool.ts — Production Tool-Use Schema

import Anthropic from "@anthropic-ai/sdk";

const client = new Anthropic({ apiKey: process.env.ANTHROPIC_API_KEY });

export async function synthesizeRemediation(telemetry: AuditTelemetry) {
  const response = await client.messages.create({
    model: "claude-sonnet-4-5",
    max_tokens: 2048,
    system: [
      {
        type: "text",
        text: OWASP_NIS2_SPECIFICATION_CORPUS,
        cache_control: { type: "ephemeral" } // Prompt caching for low-latency triage
      }
    ],
    tools: [
      {
        name: "synthesize_remediation_patch",
        description: "Emit non-breaking CSP and server config diffs from telemetry.",
        input_schema: {
          type: "object",
          properties: {
            root_cause_summary: { type: "string" },
            csp_policy: { type: "string" },
            nginx_snippet: { type: "string" },
            cloudflare_ruleset: { type: "object" },
            breaking_change_risk: { type: "string", enum: ["LOW", "MEDIUM", "HIGH"] }
          },
          required: ["root_cause_summary", "csp_policy", "nginx_snippet", "breaking_change_risk"]
        }
      }
    ],
    tool_choice: { type: "tool", name: "synthesize_remediation_patch" },
    messages: [
      { role: "user", content: JSON.stringify(telemetry) }
    ]
  });

  return response.content.find((b) => b.type === "tool_use")?.input;
}

Platform Capabilities

Built for DevOps, SecOps, and SaaS engineering teams

Programmatic visibility across every public endpoint, microservice, and customer-facing domain in your organization.

POST /api/v1/audit

Sub-Second Edge Telemetry

Measure DNS resolution, TCP/TLS handshake, Time-to-First-Byte, and HTTP response headers from global edge PoPs without installing agents.

DOM -> CSP

Non-Breaking CSP Synthesis

Automatically map external scripts, Google Fonts, CDNs, and checkout iframes into granular Content-Security-Policy directives.

MULTI-STACK

Drop-In Config Compilers

Export validated remediation artifacts tailored for Nginx, Apache .htaccess, Cloudflare Transform Rules, and Next.js middleware.

NIS2 & OWASP

Continuous Compliance Drift

Schedule recurring endpoint audits and receive structured JSON webhooks whenever a deployment strips critical security headers.

SSRF SHIELD

Hardened Perimeter Firewall

Strict RFC-1918, loopback, and cloud metadata IP filtering built into every collector worker, enforcing safe external-only scanning.

STATELESS

Zero-Retention Log Parsing

Telemetry snapshots and HTML header streams are evaluated in ephemeral memory with strict GDPR data minimization by design.

Transparent Pricing

Start with the open API sandbox, scale with your fleet

Predictable usage tiers for independent developers, growing SaaS startups, and multi-domain infrastructure teams.

Developer Sandbox

$0 / month

For testing single domains and exploring the telemetry API.

100 API telemetry probes / month
Interactive web diagnostic inspector
Structured JSON telemetry output
Baseline HTTP header checks

Try Sandbox Now

Startup & Growth

$49 / month

Full LLM-synthesized remediation and continuous monitoring.

10,000 API probes / month
Claude-powered non-breaking CSP synthesis
Nginx, Apache & Cloudflare patch export
Scheduled regression webhooks & email alerts

Request API Key

Enterprise Fleet

$199 / month

High-volume continuous compliance across domain portfolios.

Unlimited edge telemetry probes
Custom OWASP & EU NIS2 policy rulesets
CI/CD GitHub Actions deployment gates
HMAC-signed webhooks & dedicated SLA

Contact Engineering