# Security & supply-chain explorers

> A network of 13 focused, deterministic tools. Every tool has a human page, a JSON API, an OpenAPI description and an MCP tool that all return the same result (inputs, result, units, assumptions, sources, timestamps).

## Machine interfaces
- Tool catalog (JSON): https://security.usefulweb.app/api/v1/tools
- OpenAPI (all tools): https://security.usefulweb.app/openapi.json
- MCP server (all tools + workflows): https://security.usefulweb.app/mcp
- Pick a tool for a natural-language request: POST https://security.usefulweb.app/api/v1/tools/prompt-to-tool-router/calculate {"request": "..."}

## Tools
- [Artifact Provenance Explorer](https://artifactprovenanceexplorer.usefulweb.app/): Verify npm build provenance: Sigstore signature, transparency log, source repo and commit. API: POST https://security.usefulweb.app/api/v1/tools/artifact-provenance-explorer/calculate
- [C2PA Credentials Inspector](https://c2pacredentialsinspector.usefulweb.app/): Read C2PA Content Credentials in images and videos: actions, AI hints, signer and signature. API: POST https://security.usefulweb.app/api/v1/tools/c2pa-credentials-inspector/calculate
- [Container Image Explorer](https://containerimageexplorer.usefulweb.app/): Inspect a container image: platforms, layers, base image, root user, labels and cosign signature. API: POST https://security.usefulweb.app/api/v1/tools/container-image-explorer/calculate
- [CVE Relationship Graph](https://cverelationshipgraph.usefulweb.app/): One CVE or GHSA as a graph: aliases, affected packages, fixed versions, KEV status and EPSS. API: POST https://security.usefulweb.app/api/v1/tools/cve-relationship-graph/calculate
- [Dependency Vulnerability Explorer](https://dependencyvulnerabilityexplorer.usefulweb.app/): Known vulnerabilities in your dependencies, and the version that fixes each one. API: POST https://security.usefulweb.app/api/v1/tools/dependency-vulnerability-explorer/calculate
- [OAuth Permission Explorer](https://oauthpermissionexplorer.usefulweb.app/): What an OAuth consent request really allows: scopes, risky combinations and flow problems. API: POST https://security.usefulweb.app/api/v1/tools/oauth-permission-explorer/calculate
- [Open Source Trust Explorer](https://opensourcetrustexplorer.usefulweb.app/): Is this open-source project maintained and trustworthy? Scorecard, activity and provenance. API: POST https://security.usefulweb.app/api/v1/tools/open-source-trust-explorer/calculate
- [Package Ecosystem Graph](https://packageecosystemgraph.usefulweb.app/): Who depends on what: resolved dependency graph, duplicates and the blast radius of breaking changes. API: POST https://security.usefulweb.app/api/v1/tools/package-ecosystem-graph/calculate
- [Passkey & WebAuthn Tester](https://passkeywebauthntester.usefulweb.app/): Test passkeys in your browser and decode WebAuthn responses: flags, AAGUID, signatures. API: POST https://security.usefulweb.app/api/v1/tools/passkey-webauthn-tester/calculate
- [SBOM Explorer](https://sbomexplorer.usefulweb.app/): Open a CycloneDX or SPDX SBOM: components, licences, dependency tree and known vulnerabilities. API: POST https://security.usefulweb.app/api/v1/tools/sbom-explorer/calculate
- [SBOM License Checker](https://sbomlicensechecker.usefulweb.app/): Check SBOM licences: SPDX expressions, copyleft class and conflicts with your project licence. API: POST https://security.usefulweb.app/api/v1/tools/sbom-license-checker/calculate
- [Security Advisory Timeline](https://securityadvisorytimeline.usefulweb.app/): Disclosures, affected ranges, fixes and withdrawals for a package on one timeline, with time-to-fix. API: POST https://security.usefulweb.app/api/v1/tools/security-advisory-timeline/calculate
- [Security Configuration Scanner](https://securityconfigurationscanner.usefulweb.app/): Passive, graded check of a domain's TLS, security headers, DNS security and security.txt. API: POST https://security.usefulweb.app/api/v1/tools/security-configuration-scanner/calculate

## Workflows