API & MCP

Everything a person can do on Security & supply-chain explorers, a program or AI agent can do with the same inputs and get the identical result.

HTTP API

• GET https://security.usefulweb.site/api/v1/tools – catalog
• GET https://security.usefulweb.site/api/v1/tools/{id} – inputs, output schema, examples
• POST https://security.usefulweb.site/api/v1/tools/{id}/calculate – run a tool
• GET https://security.usefulweb.site/api/v1/workflows · POST https://security.usefulweb.site/api/v1/workflows/{id}/run
• OpenAPI 3.1: /openapi.json · /openapi.yaml
• Errors: application/problem+json; 422 includes per-field errors.

Every result contains

inputs (normalised, defaults applied), summary, result (validated against the published schema), units, assumptions, sources, warnings, computedAt and links.

MCP (Model Context Protocol)

• Streamable HTTP endpoint: https://security.usefulweb.site/mcp – protocol revisions 2026-07-28 (stateless) and 2025-11-25 / 2025-06-18 / 2025-03-26 (initialize handshake).
• Tools: artifact_provenance_explorer, container_image_explorer, cve_relationship_graph, dependency_vulnerability_explorer, oauth_permission_explorer, open_source_trust_explorer, package_ecosystem_graph, sbom_explorer, security_advisory_timeline, security_configuration_scanner
• Local stdio connector: node src/mcp-stdio.ts

{
  "mcpServers": {
    "usefulweb": { "type": "http", "url": "https://security.usefulweb.site/mcp" }
  }
}