# Security & supply-chain explorers

> A network of 10 focused, deterministic tools. Every tool has a human page, a JSON API, an OpenAPI description and an MCP tool that all return the same result (inputs, result, units, assumptions, sources, timestamps).

## Machine interfaces
- Tool catalog (JSON): https://security.usefulweb.site/api/v1/tools
- OpenAPI (all tools): https://security.usefulweb.site/openapi.json
- MCP server (all tools + workflows): https://security.usefulweb.site/mcp
- Pick a tool for a natural-language request: POST https://security.usefulweb.site/api/v1/tools/prompt-to-tool-router/calculate {"request": "..."}

## Tools
- [Artifact Provenance Explorer](https://artifactprovenanceexplorer.usefulweb.site/): Verify npm build provenance: Sigstore signature, transparency log, source repo and commit. API: POST https://security.usefulweb.site/api/v1/tools/artifact-provenance-explorer/calculate
- [Container Image Explorer](https://containerimageexplorer.usefulweb.site/): Inspect a container image: platforms, layers, base image, root user, labels and cosign signature. API: POST https://security.usefulweb.site/api/v1/tools/container-image-explorer/calculate
- [CVE Relationship Graph](https://cverelationshipgraph.usefulweb.site/): One CVE or GHSA as a graph: aliases, affected packages, fixed versions, KEV status and EPSS. API: POST https://security.usefulweb.site/api/v1/tools/cve-relationship-graph/calculate
- [Dependency Vulnerability Explorer](https://dependencyvulnerabilityexplorer.usefulweb.site/): Known vulnerabilities in your dependencies, and the version that fixes each one. API: POST https://security.usefulweb.site/api/v1/tools/dependency-vulnerability-explorer/calculate
- [OAuth Permission Explorer](https://oauthpermissionexplorer.usefulweb.site/): What an OAuth consent request really allows: scopes, risky combinations and flow problems. API: POST https://security.usefulweb.site/api/v1/tools/oauth-permission-explorer/calculate
- [Open Source Trust Explorer](https://opensourcetrustexplorer.usefulweb.site/): Is this open-source project maintained and trustworthy? Scorecard, activity and provenance. API: POST https://security.usefulweb.site/api/v1/tools/open-source-trust-explorer/calculate
- [Package Ecosystem Graph](https://packageecosystemgraph.usefulweb.site/): Who depends on what: resolved dependency graph, duplicates and the blast radius of breaking changes. API: POST https://security.usefulweb.site/api/v1/tools/package-ecosystem-graph/calculate
- [SBOM Explorer](https://sbomexplorer.usefulweb.site/): Open a CycloneDX or SPDX SBOM: components, licences, dependency tree and known vulnerabilities. API: POST https://security.usefulweb.site/api/v1/tools/sbom-explorer/calculate
- [Security Advisory Timeline](https://securityadvisorytimeline.usefulweb.site/): Disclosures, affected ranges, fixes and withdrawals for a package on one timeline, with time-to-fix. API: POST https://security.usefulweb.site/api/v1/tools/security-advisory-timeline/calculate
- [Security Configuration Scanner](https://securityconfigurationscanner.usefulweb.site/): Passive, graded check of a domain's TLS, security headers, DNS security and security.txt. API: POST https://security.usefulweb.site/api/v1/tools/security-configuration-scanner/calculate

## Workflows