MoonCSP checks CSP source lists. It does not generate nonces, hash script bodies, or enforce policies inside a browser. Callers must supply origin, nonce, and sha256 values they already computed.