Security Tools

Security APIs — headers, CSP, TLS, cookies, CORS, JWT, secrets, and more. REST, SDK, MCP.

TypeScript SDK

Namespace: ty.security. URL tools: pass { url }. Body tools: pass JSON fields from OpenAPI. Full table: SDK Tool Map → Security APIs.

import { ToolYour } from "@toolyour/sdk";
const ty = ToolYour({ apiKey: process.env.TOOLYOUR_API_KEY! });

await ty.security.securityHeadersAnalyzer({ url: "https://example.com" });
await ty.security.jwtDecoder({ token: "eyJ…" });
await ty.security.secretLeakScanner({ text: "paste config or log…" });

Security APIs

Base path: /api/v1/security-apis

All tool calls require X-Api-Key. Catalog listing does not.

curl -G "https://api.toolyour.com/api/v1/security-apis/catalog"

Interactive OpenAPI: API Reference (Security APIs tag).
Public paths and MDX slugs use kebab-case (hyphens). Internal OpenAPI operationId values may be camelCase — always call the kebab-case URL path.

Auth

X-Api-Key: ty_YOUR_KEY

URL / DNS tools (GET or POST)

GET uses ?url=…. POST uses JSON {"url":"…"} (or a domain for DNS / email auth).
ssl-tls-certificate-checker POST also accepts offline {"pem":"…"} or {"csr":"…"}.

Path (kebab-case)	Methods	Notes
`/security-headers-analyzer`	GET, POST	CSP, HSTS, XFO, and related headers
`/ssl-tls-certificate-checker`	GET, POST	Live HTTPS cert; optional PEM/CSR offline
`/cookie-security-analyzer`	GET, POST	Secure / HttpOnly / SameSite
`/spf-dkim-dmarc-checker`	GET, POST	Email auth DNS
`/cors-policy-checker`	GET, POST	ACAO / credentials / Origin probe
`/http-security-redirect-checker`	GET, POST	HTTP→HTTPS, loops, open-redirect signals
`/dns-lookup`	GET, POST	A/AAAA/MX/TXT/NS/CNAME + DNSSEC record presence
`/security-txt-checker`	GET, POST	RFC 9116 `/.well-known/security.txt`
`/subresource-integrity-checker`	GET, POST	Missing `integrity=` on third-party assets

curl -G "https://api.toolyour.com/api/v1/security-apis/security-headers-analyzer" \
  -H "X-Api-Key: $API_KEY" \
  --data-urlencode "url=https://example.com"

curl -X POST "https://api.toolyour.com/api/v1/security-apis/dns-lookup" \
  -H "Content-Type: application/json" \
  -H "X-Api-Key: $API_KEY" \
  -d '{"url":"example.com"}'

Local / body tools (POST only)

Path (kebab-case)	Body highlights
`/secret-leak-scanner`	`{"text":"…"}`
`/jwt-decoder`	`{"token":"…"}` — decode only, no signature verify
`/jwt-signature-verifier`	`{"token","secret"}` or `publicKey` / `jwk`
`/csp-policy-evaluator`	`{"policy":"…"}`
`/webhook-signature-verifier`	`payload`, `secret`, `signature`, `scheme` (`hmac-sha256`, `github`, or `stripe`)
`/hmac-generator`	`text`, `secret`, `algorithm`; optional `expected`
`/bcrypt-hash-generator`	`password`, `algorithm` (`bcrypt` or `argon2id`)
`/password-strength-checker`	`{"password":"…"}`
`/secure-password-generator`	`length`, `symbols`, …
`/hash-generator`	`text`, `algorithm`

Examples

CSP policy evaluator

curl -X POST "https://api.toolyour.com/api/v1/security-apis/csp-policy-evaluator" \
  -H "Content-Type: application/json" \
  -H "X-Api-Key: $API_KEY" \
  -d "{\"policy\":\"default-src 'self'; script-src 'self'\"}"

JWT signature verifier

curl -X POST "https://api.toolyour.com/api/v1/security-apis/jwt-signature-verifier" \
  -H "Content-Type: application/json" \
  -H "X-Api-Key: $API_KEY" \
  -d '{"token":"eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxIn0.sig","secret":"test-secret"}'

Webhook signature verifier

curl -X POST "https://api.toolyour.com/api/v1/security-apis/webhook-signature-verifier" \
  -H "Content-Type: application/json" \
  -H "X-Api-Key: $API_KEY" \
  -d '{"payload":"{\"ok\":true}","secret":"whsec_test","signature":"sha256=…","scheme":"github"}'

Password hash (bcrypt or Argon2id)

curl -X POST "https://api.toolyour.com/api/v1/security-apis/bcrypt-hash-generator" \
  -H "Content-Type: application/json" \
  -H "X-Api-Key: $API_KEY" \
  -d '{"password":"test-only","algorithm":"argon2id"}'

Secret leak scanner

curl -X POST "https://api.toolyour.com/api/v1/security-apis/secret-leak-scanner" \
  -H "Content-Type: application/json" \
  -H "X-Api-Key: $API_KEY" \
  -d '{"text":"AWS_ACCESS_KEY_ID=AKIA..."}'

hasApi coverage

Every security tool in the public catalog is API-backed (hasApi: true) under /api/v1/security-apis/<kebab-slug> and is listed in the OpenAPI Security APIs tag. Browser pages: /security-tools/<kebab-slug>.

MCP

Skills: web-security-audit, secrets-and-auth-hygiene, developer-ship-checklist, dns-email-security.
Workflows: full-security-audit, security-headers-job, developer-ship-checklist-job, secrets-hygiene-job, email-auth-security-job.
See MCP Skills.

Scope notes

TLS checker is not a full SSL Labs grade; DNSSEC section reports record presence only.
JWT decode does not verify signatures — use /jwt-signature-verifier.
Secret leak scan is heuristic, not a breach database.
Prefer Argon2id / bcrypt for password storage tests; plain /hash-generator digests are not password KDFs.
Mixed HTTP assets: SEO Mixed Content / /digital-tools/mixed-content-checker (not duplicated here).

Credits

URL / DNS fetches typically ~3 credits; local CSP / JWT / webhook / hash / HMAC / secret-scan ~1. See Usage & Plans.

Security Tools

On this page