SysCore Tools

Developers

API

Same checks as the website, over HTTP. Anonymous requests are rate-limited by IP. Pass Authorization: Bearer st_… for higher limits. Create a token with php artisan tools:token.

Envelope

{
  "status": 200,
  "msg": "OK",
  "data": { }
}

List tools

GET /api/v1/tools

Start a run

POST /api/v1/tools/{tool}/runs
Content-Type: application/json

{
  "target": "https://example.com",
  "consent": true
}

Vulnerability scan: POST /api/v1/tools/vuln/runs. Sync tools return 200; queued tools return 202 — poll the run URL.

Get run

GET /api/v1/runs/{id}

Available tools

  • dns — DNS Lookup

    See which servers answer for your domain — web, mail, nameservers and TXT records in one place.

  • mail-auth — SPF / DKIM / DMARC

    Check whether your domain publishes the DNS records that stop spoofing and improve inbox delivery.

  • ssl — SSL / TLS Check

    Verify the HTTPS certificate: expiry, issuer, and whether it matches your hostname.

  • headers — Security Headers

    Audit the HTTP response headers that harden browsers against XSS, clickjacking and mixed content.

  • redirects — Redirect Chain

    Follow every hop from a URL to the final page — useful for http→https and www cleanup.

  • rdap — Domain RDAP / WHOIS

    Lookup domain registration status, nameservers and expiry date via RDAP.

  • robots-sitemap — robots.txt & Sitemap

    Confirm crawlers can find robots.txt and a valid sitemap.xml.

  • email-check — Email Check async

    Paste a raw email and see how authentication headers look for deliverability.

  • seo — SEO Snapshot async

    Real Lighthouse lab check for SEO, accessibility and best-practices (not a speed test).

  • performance — Site Performance (CWV) async

    Lighthouse performance score + Core Web Vitals style metrics (LCP, CLS, TBT, FCP) and top opportunities.

  • sitemap-crawl — Site Map & Broken Links async

    Crawl internal pages from a start URL and list broken or error responses.

  • vuln — Vulnerability & Exposure Scan async

    Serious automated check for leaked .git/.env/configs, tokens, backups, dumps and known web exposures (Nuclei + path probes).

  • ports — Port Scan (nmap) async

    Classic nmap recon: discover open TCP ports and risky services (SSH, RDP, MySQL, Redis, Mongo…).