Local analysis is not remote verification
Unless a tool explicitly has a direct-fetch action, these HTTP tools do not contact endpoints. Browser fetch cannot bypass CORS, and generated policy text does not prove how a deployed server, browser, proxy or CDN will behave.