A2Z Tools MCP

Hosted, read-only MCP server with 68 website and domain checks: SSL/TLS certificates, DNS records, SPF/DKIM/DMARC email authentication, WHOIS, HTTP and security headers, redirects and more. Remote Streamable HTTP endpoint at https://a2z.tools/mcp, no install; free tier with an optional API key.

View on a2z.tools

Hosted MCP Server

npx add-mcp 'https://a2z.tools/mcp'

Installs into Claude Code, Codex, Cursor and more

Documentation

Access Per minute Per day

No key (per IP) 10 100

Free key 60 2,000

Higher volume Email [email protected]

Quick start

Every endpoint is a GET request. Send your key in the X-API-Key header (or leave it out to use the no-key limits).

curl -H "X-API-Key: YOUR_KEY" \
  "https://a2z.tools/public-api/v1/ssl/certificate?host=example.com"

// JavaScript (browser or Node 18+)
const res = await fetch("https://a2z.tools/public-api/v1/email/dmarc?domain=example.com", {
  headers: { "X-API-Key": "YOUR_KEY" }
});
const data = await res.json();   // { ok: true, ... }

# Python
import requests
r = requests.get("https://a2z.tools/public-api/v1/dns/records",
                 params={"domain": "example.com", "type": "MX"},
                 headers={"X-API-Key": "YOUR_KEY"})
print(r.json())

Responses, limits and errors

Answers are JSON with ok (true or false). Each check adds its own fields. Click any endpoint below to see a live example.
Every answer carries X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset (Unix time, next 00:00 UTC). A 429 also sends Retry-After in seconds.
Results are cached for a few minutes (the time is shown per endpoint). X-A2Z-Cache: HIT means you got a cached answer, which still counts as a call.
Errors look like {"ok": false, "code": "invalid_key", "error": "..."}. The codes are missing_parameter, invalid_key, key_suspended, key_revoked, key_required, rate_limited, daily_quota, target_rate_limited and api_disabled.
CORS is open, so you can call the API from a web page. Don't put a key in public front-end code: call without one, or proxy the call through your server.
To protect the sites being checked, one site can receive 30 fresh checks a minute through the API, whoever sends them.

Attribution

The API is free. If you show its results publicly, please credit Data by A2Z Tools. It helps us keep it free.

Use it in your AI assistant (MCP server)

Every endpoint is also a tool on our remote MCP server, so Claude, ChatGPT, Cursor, VS Code and other AI clients can check a site for you: "Is the SSL certificate on example.com about to expire?" or "Why are my emails going to spam?"

https://a2z.tools/mcp

Claude (claude.ai or Claude Desktop): Settings → Connectors → Add custom connector, and paste the URL.
Claude Code: claude mcp add --transport http a2z-tools https://a2z.tools/mcp
ChatGPT: Settings → Apps & Connectors → Create (developer mode), and paste the URL.
Cursor, VS Code, Windsurf and other clients that take an mcp.json:

{
  "mcpServers": {
    "a2z-tools": {
      "url": "https://a2z.tools/mcp",
      "headers": { "Authorization": "Bearer YOUR_KEY" }
    }
  }
}

The key is optional, as with the REST API: without one you get the no-key limits for your IP. If a client cannot send headers, add it to the URL instead: https://a2z.tools/mcp?api_key=YOUR_KEY. All 68 tools are read-only. They only look at public information about the site you name, and each call counts against your limits like any API call.

Endpoints

Base URL https://a2z.tools/public-api/v1

SSL / TLS

Certificates, expiry, protocols, HSTS, OCSP and certificate transparency.

GET /ssl/certificate Certificate details and expiry

Connects to the host and returns the certificate chain, issuer, subject alternative names, validity dates and days until expiry.

Parameter	Required	Description
`host`	yes	Host name (example.com). e.g. `example.com`
`port`	no	TCP port, default 443. e.g. `443`

Cached 30 min · Try it in the browser

curl "https://a2z.tools/public-api/v1/ssl/certificate?host=example.com"

GET /ssl/protocols Supported TLS versions

Which TLS protocol versions the server accepts (TLS 1.0 to 1.3).

Parameter	Required	Description
`host`	yes	Host name (example.com). e.g. `example.com`
`port`	no	TCP port, default 443. e.g. `443`

Cached 30 min

curl "https://a2z.tools/public-api/v1/ssl/protocols?host=example.com"

GET /ssl/https HTTPS availability

Whether the domain answers over HTTPS with a valid certificate.

Parameter	Required	Description
`domain`	yes	Domain name, without https:// (example.com). e.g. `example.com`

Cached 30 min

curl "https://a2z.tools/public-api/v1/ssl/https?domain=example.com"

GET /ssl/https-redirect HTTP to HTTPS redirect

Whether plain HTTP redirects to HTTPS, and how.

Parameter	Required	Description
`domain`	yes	Domain name, without https:// (example.com). e.g. `example.com`

Cached 30 min

curl "https://a2z.tools/public-api/v1/ssl/https-redirect?domain=example.com"

GET /ssl/hsts HSTS header

The Strict-Transport-Security header, parsed and checked.

Parameter	Required	Description
`domain`	yes	Domain name, without https:// (example.com). e.g. `example.com`

Cached 30 min

curl "https://a2z.tools/public-api/v1/ssl/hsts?domain=example.com"

GET /ssl/hsts-preload HSTS preload eligibility

Whether the domain meets the hstspreload.org requirements.

Parameter	Required	Description
`domain`	yes	Domain name, without https:// (example.com). e.g. `example.com`

Cached 30 min

curl "https://a2z.tools/public-api/v1/ssl/hsts-preload?domain=example.com"

GET /ssl/ocsp OCSP status

Asks the certificate's OCSP responder whether it has been revoked.

Parameter	Required	Description
`url`	yes	Full URL including https://. e.g. `https://example.com`

Cached 30 min

curl "https://a2z.tools/public-api/v1/ssl/ocsp?url=https%3A%2F%2Fexample.com"

GET /ssl/crl CRL revocation check

Checks the certificate against its CRL distribution point.

Parameter	Required	Description
`url`	yes	Full URL including https://. e.g. `https://example.com`

Cached 30 min

curl "https://a2z.tools/public-api/v1/ssl/crl?url=https%3A%2F%2Fexample.com"

GET /ssl/ciphers Cipher suites

The cipher suites the server negotiates, graded.

Parameter	Required	Description
`url`	yes	Full URL including https://. e.g. `https://example.com`

Cached 30 min

curl "https://a2z.tools/public-api/v1/ssl/ciphers?url=https%3A%2F%2Fexample.com"

GET /ssl/certificate-transparency Certificate transparency

Certificates logged for the domain in public CT logs.

Parameter	Required	Description
`url`	yes	Full URL including https://. e.g. `https://example.com`

Cached 30 min

curl "https://a2z.tools/public-api/v1/ssl/certificate-transparency?url=https%3A%2F%2Fexample.com"

DNS

Records, propagation across public resolvers, reverse DNS and DNSSEC.

GET /dns/records DNS records

A, AAAA, CNAME, MX, NS, TXT, SOA, CAA and more. Omit type to get all common types.

Parameter	Required	Description
`domain`	yes	Domain name, without https:// (example.com). e.g. `example.com`
`type`	no	Record type (A, AAAA, MX, TXT, NS, CNAME, SOA, CAA, SRV, PTR). Omit for all. e.g. `MX`

Cached 5 min · Try it in the browser

curl "https://a2z.tools/public-api/v1/dns/records?domain=example.com"

GET /dns/propagation DNS propagation

The answer from several public resolvers around the world, side by side.

Parameter	Required	Description
`domain`	yes	Domain name, without https:// (example.com). e.g. `example.com`
`type`	no	Record type, default A. e.g. `A`

Cached 5 min · counts as 2 calls · Try it in the browser

curl "https://a2z.tools/public-api/v1/dns/propagation?domain=example.com"

GET /dns/reverse Reverse DNS (PTR)

The PTR name for an IP address.

Parameter	Required	Description
`ip`	yes	IPv4 or IPv6 address. e.g. `8.8.8.8`

Cached 5 min

curl "https://a2z.tools/public-api/v1/dns/reverse?ip=8.8.8.8"

GET /dns/dnssec DNSSEC

Whether the zone is signed and the chain of trust validates.

Parameter	Required	Description
`domain`	yes	Domain name, without https:// (example.com). e.g. `example.com`

Cached 5 min

curl "https://a2z.tools/public-api/v1/dns/dnssec?domain=example.com"

Email authentication

SPF, DKIM, DMARC, BIMI, MTA-STS and TLS-RPT, separately or as one graded check.

GET /email/security Email security grade

SPF, DKIM, DMARC, BIMI, MTA-STS and TLS-RPT in one graded report.

Parameter	Required	Description
`domain`	yes	Domain name, without https:// (example.com). e.g. `example.com`
`dkimSelector`	no	DKIM selector to check (google, selector1, k1...). e.g. `google`

Cached 15 min · Try it in the browser

curl "https://a2z.tools/public-api/v1/email/security?domain=example.com"

GET /email/spf SPF record

The SPF record, parsed, with the DNS look-up count and problems.

Parameter	Required	Description
`domain`	yes	Domain name, without https:// (example.com). e.g. `example.com`

Cached 15 min · Try it in the browser

curl "https://a2z.tools/public-api/v1/email/spf?domain=example.com"

GET /email/dmarc DMARC record

The DMARC policy, parsed, with reporting addresses and problems.

Parameter	Required	Description
`domain`	yes	Domain name, without https:// (example.com). e.g. `example.com`

Cached 15 min · Try it in the browser

curl "https://a2z.tools/public-api/v1/email/dmarc?domain=example.com"

GET /email/dkim DKIM record

The DKIM public key for a selector, parsed.

Parameter	Required	Description
`domain`	yes	Domain name, without https:// (example.com). e.g. `example.com`
`selector`	yes	DKIM selector. e.g. `google`

Cached 15 min · Try it in the browser

curl "https://a2z.tools/public-api/v1/email/dkim?domain=example.com&selector=google"

GET /email/bimi BIMI record

The BIMI record and logo location.

Parameter	Required	Description
`domain`	yes	Domain name, without https:// (example.com). e.g. `example.com`
`selector`	no	BIMI selector, default 'default'. e.g. `default`

Cached 15 min

curl "https://a2z.tools/public-api/v1/email/bimi?domain=example.com"

GET /email/mta-sts MTA-STS

The MTA-STS DNS record and policy file.

Parameter	Required	Description
`domain`	yes	Domain name, without https:// (example.com). e.g. `example.com`

Cached 15 min

curl "https://a2z.tools/public-api/v1/email/mta-sts?domain=example.com"

GET /email/tls-rpt TLS-RPT

The SMTP TLS reporting record.

Parameter	Required	Description
`domain`	yes	Domain name, without https:// (example.com). e.g. `example.com`

Cached 15 min

curl "https://a2z.tools/public-api/v1/email/tls-rpt?domain=example.com"

Domain & IP

WHOIS over RDAP, IP and ASN information, reverse IP.

GET /domain/whois WHOIS (RDAP)

Registrar, registration and expiry dates, status and name servers, from RDAP.

Parameter	Required	Description
`domain`	yes	Domain name, without https:// (example.com). e.g. `example.com`

Cached 1 h · Try it in the browser

curl "https://a2z.tools/public-api/v1/domain/whois?domain=example.com"

GET /domain/ip IP information

Network, owner and location information for an IP address.

Parameter	Required	Description
`ip`	yes	IPv4 or IPv6 address. e.g. `8.8.8.8`

Cached 1 h

curl "https://a2z.tools/public-api/v1/domain/ip?ip=8.8.8.8"

GET /domain/asn ASN information

The organisation and prefixes of an autonomous system.

Parameter	Required	Description
`asn`	yes	AS number, with or without the AS prefix. e.g. `AS15169`

Cached 1 h

curl "https://a2z.tools/public-api/v1/domain/asn?asn=AS15169"

GET /domain/reverse-ip Reverse IP

Other host names seen on the same IP address.

Parameter	Required	Description
`ip`	yes	IPv4 or IPv6 address. e.g. `8.8.8.8`

Cached 1 h

curl "https://a2z.tools/public-api/v1/domain/reverse-ip?ip=8.8.8.8"

HTTP & headers

Status, redirects, response headers, security headers, CSP, CORS, cookies, caching and performance basics.

GET /http/headers Response headers

The response headers of a URL.

Parameter	Required	Description
`url`	yes	Full URL including https://. e.g. `https://example.com`

Cached 5 min · Try it in the browser

curl "https://a2z.tools/public-api/v1/http/headers?url=https%3A%2F%2Fexample.com"

GET /http/status HTTP status

The status code and response time of a URL.

Parameter	Required	Description
`url`	yes	Full URL including https://. e.g. `https://example.com`

Cached 5 min

curl "https://a2z.tools/public-api/v1/http/status?url=https%3A%2F%2Fexample.com"

GET /http/redirects Redirect chain

Every hop from the URL to its final destination.

Parameter	Required	Description
`url`	yes	Full URL including https://. e.g. `https://example.com`

Cached 5 min

curl "https://a2z.tools/public-api/v1/http/redirects?url=https%3A%2F%2Fexample.com"

GET /http/security-headers Security headers grade

HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy, graded.

Parameter	Required	Description
`url`	yes	Full URL including https://. e.g. `https://example.com`

Cached 5 min · Try it in the browser

curl "https://a2z.tools/public-api/v1/http/security-headers?url=https%3A%2F%2Fexample.com"

GET /http/csp Content-Security-Policy

The CSP header parsed directive by directive, with weaknesses.

Parameter	Required	Description
`url`	yes	Full URL including https://. e.g. `https://example.com`

Cached 5 min

curl "https://a2z.tools/public-api/v1/http/csp?url=https%3A%2F%2Fexample.com"

GET /http/cors CORS configuration

The CORS headers a URL sends, with risky combinations flagged.

Parameter	Required	Description
`url`	yes	Full URL including https://. e.g. `https://example.com`

Cached 5 min

curl "https://a2z.tools/public-api/v1/http/cors?url=https%3A%2F%2Fexample.com"

GET /http/cookies Cookies

Cookies set by the URL and their Secure, HttpOnly and SameSite flags.

Parameter	Required	Description
`url`	yes	Full URL including https://. e.g. `https://example.com`

Cached 5 min

curl "https://a2z.tools/public-api/v1/http/cookies?url=https%3A%2F%2Fexample.com"

GET /http/methods Allowed HTTP methods

Which HTTP methods the server accepts.

Parameter	Required	Description
`url`	yes	Full URL including https://. e.g. `https://example.com`

Cached 5 min

curl "https://a2z.tools/public-api/v1/http/methods?url=https%3A%2F%2Fexample.com"

GET /http/server-banner Server banner

Server software and version disclosed in headers.

Parameter	Required	Description
`url`	yes	Full URL including https://. e.g. `https://example.com`

Cached 5 min

curl "https://a2z.tools/public-api/v1/http/server-banner?url=https%3A%2F%2Fexample.com"

GET /http/framing Clickjacking protection

Whether the page can be framed by other sites.

Parameter	Required	Description
`url`	yes	Full URL including https://. e.g. `https://example.com`

Cached 5 min

curl "https://a2z.tools/public-api/v1/http/framing?url=https%3A%2F%2Fexample.com"

GET /http/cross-origin Cross-origin headers

COOP, COEP and CORP headers.

Parameter	Required	Description
`url`	yes	Full URL including https://. e.g. `https://example.com`

Cached 5 min

curl "https://a2z.tools/public-api/v1/http/cross-origin?url=https%3A%2F%2Fexample.com"

GET /http/cross-origin-isolation Cross-origin isolation

Whether the page is cross-origin isolated.

Parameter	Required	Description
`url`	yes	Full URL including https://. e.g. `https://example.com`

Cached 5 min

curl "https://a2z.tools/public-api/v1/http/cross-origin-isolation?url=https%3A%2F%2Fexample.com"

GET /http/permissions-policy Permissions-Policy

The Permissions-Policy header, parsed.

Parameter	Required	Description
`url`	yes	Full URL including https://. e.g. `https://example.com`

Cached 5 min

curl "https://a2z.tools/public-api/v1/http/permissions-policy?url=https%3A%2F%2Fexample.com"

GET /http/referrer-policy Referrer-Policy

The Referrer-Policy in effect.

Parameter	Required	Description
`url`	yes	Full URL including https://. e.g. `https://example.com`

Cached 5 min

curl "https://a2z.tools/public-api/v1/http/referrer-policy?url=https%3A%2F%2Fexample.com"

GET /http/compression Compression

Whether gzip, Brotli or zstd is served.

Parameter	Required	Description
`url`	yes	Full URL including https://. e.g. `https://example.com`

Cached 5 min

curl "https://a2z.tools/public-api/v1/http/compression?url=https%3A%2F%2Fexample.com"

GET /http/cache-control Caching headers

Cache-Control, ETag, Last-Modified and Expires, explained.

Parameter	Required	Description
`url`	yes	Full URL including https://. e.g. `https://example.com`

Cached 5 min

curl "https://a2z.tools/public-api/v1/http/cache-control?url=https%3A%2F%2Fexample.com"

GET /http/protocol HTTP version

HTTP/1.1, HTTP/2 or HTTP/3 support.

Parameter	Required	Description
`url`	yes	Full URL including https://. e.g. `https://example.com`

Cached 5 min

curl "https://a2z.tools/public-api/v1/http/protocol?url=https%3A%2F%2Fexample.com"

GET /http/ttfb Time to first byte

DNS, connect, TLS and first-byte timings from our server.

Parameter	Required	Description
`url`	yes	Full URL including https://. e.g. `https://example.com`

Cached 1 min

curl "https://a2z.tools/public-api/v1/http/ttfb?url=https%3A%2F%2Fexample.com"

GET /http/cdn CDN detection

Which CDN serves the domain, if any.

Parameter	Required	Description
`domain`	yes	Domain name, without https:// (example.com). e.g. `example.com`

Cached 5 min

curl "https://a2z.tools/public-api/v1/http/cdn?domain=example.com"

GET /http/static-assets Static asset audit

Size, caching and compression of the page's scripts, styles and images.

Parameter	Required	Description
`url`	yes	Full URL including https://. e.g. `https://example.com`

Cached 5 min

curl "https://a2z.tools/public-api/v1/http/static-assets?url=https%3A%2F%2Fexample.com"

SEO & crawlers

Open Graph, canonical, hreflang, structured data, robots.txt, sitemaps, llms.txt, AI crawler access and ads.txt.

GET /seo/open-graph Open Graph & Twitter cards

og: and twitter: tags, with missing or broken values flagged.

Parameter	Required	Description
`url`	yes	Full URL including https://. e.g. `https://example.com`

Cached 10 min

curl "https://a2z.tools/public-api/v1/seo/open-graph?url=https%3A%2F%2Fexample.com"

GET /seo/canonical Canonical URL

The canonical link and whether it agrees with the URL.

Parameter	Required	Description
`url`	yes	Full URL including https://. e.g. `https://example.com`

Cached 10 min

curl "https://a2z.tools/public-api/v1/seo/canonical?url=https%3A%2F%2Fexample.com"

GET /seo/hreflang hreflang

hreflang alternates and reciprocal-link problems.

Parameter	Required	Description
`url`	yes	Full URL including https://. e.g. `https://example.com`

Cached 10 min

curl "https://a2z.tools/public-api/v1/seo/hreflang?url=https%3A%2F%2Fexample.com"

GET /seo/schema Structured data

JSON-LD, Microdata and RDFa found on the page, validated.

Parameter	Required	Description
`url`	yes	Full URL including https://. e.g. `https://example.com`

Cached 10 min

curl "https://a2z.tools/public-api/v1/seo/schema?url=https%3A%2F%2Fexample.com"

GET /seo/mixed-content Mixed content

HTTP resources loaded by an HTTPS page.

Parameter	Required	Description
`url`	yes	Full URL including https://. e.g. `https://example.com`

Cached 10 min

curl "https://a2z.tools/public-api/v1/seo/mixed-content?url=https%3A%2F%2Fexample.com"

GET /seo/technology Technology detection

CMS, frameworks, analytics and hosting the page uses.

Parameter	Required	Description
`url`	yes	Full URL including https://. e.g. `https://example.com`

Cached 10 min

curl "https://a2z.tools/public-api/v1/seo/technology?url=https%3A%2F%2Fexample.com"

GET /seo/robots-txt robots.txt

The robots.txt file, parsed by user agent.

Parameter	Required	Description
`domain`	yes	Domain name, without https:// (example.com). e.g. `example.com`

Cached 10 min · Try it in the browser

curl "https://a2z.tools/public-api/v1/seo/robots-txt?domain=example.com"

GET /seo/sitemap XML sitemap

Fetches and validates an XML sitemap or sitemap index.

Parameter	Required	Description
`url`	yes	Full URL including https://. e.g. `https://example.com/sitemap.xml`

Cached 10 min

curl "https://a2z.tools/public-api/v1/seo/sitemap?url=https%3A%2F%2Fexample.com%2Fsitemap.xml"

GET /seo/llms-txt llms.txt

Whether the site publishes /llms.txt, and whether it is well formed.

Parameter	Required	Description
`domain`	yes	Domain name, without https:// (example.com). e.g. `example.com`

Cached 10 min · Try it in the browser

curl "https://a2z.tools/public-api/v1/seo/llms-txt?domain=example.com"

GET /seo/ai-crawlers AI crawler access

Which AI crawlers (GPTBot, ClaudeBot, PerplexityBot, Google-Extended and others) robots.txt allows.

Parameter	Required	Description
`domain`	yes	Domain name, without https:// (example.com). e.g. `example.com`

Cached 10 min · Try it in the browser

curl "https://a2z.tools/public-api/v1/seo/ai-crawlers?domain=example.com"

GET /seo/ads-txt ads.txt

The ads.txt file, parsed and validated.

Parameter	Required	Description
`domain`	yes	Domain name, without https:// (example.com). e.g. `example.com`

Cached 10 min · Try it in the browser

curl "https://a2z.tools/public-api/v1/seo/ads-txt?domain=example.com"

GET /seo/app-ads-txt app-ads.txt

The app-ads.txt file, parsed and validated.

Parameter	Required	Description
`domain`	yes	Domain name, without https:// (example.com). e.g. `example.com`

Cached 10 min

curl "https://a2z.tools/public-api/v1/seo/app-ads-txt?domain=example.com"

Site health

One-call health summaries, PWA manifest, favicon, security.txt and front-end dependency checks.

GET /site/health Website health summary

DNS, HTTPS, certificate expiry, security headers and email authentication in one call. Counts as 3 calls.

Parameter	Required	Description
`domain`	yes	Domain name, without https:// (example.com). e.g. `example.com`

Cached 15 min · counts as 3 calls · Try it in the browser

curl "https://a2z.tools/public-api/v1/site/health?domain=example.com"

GET /site/audit Website security audit

The full security audit behind the A2Z website audit tool. Counts as 5 calls.

Parameter	Required	Description
`domain`	yes	Domain name, without https:// (example.com). e.g. `example.com`

Cached 15 min · counts as 5 calls

curl "https://a2z.tools/public-api/v1/site/audit?domain=example.com"

GET /site/security-txt security.txt

The /.well-known/security.txt file, parsed and validated.

Parameter	Required	Description
`domain`	yes	Domain name, without https:// (example.com). e.g. `example.com`

Cached 15 min

curl "https://a2z.tools/public-api/v1/site/security-txt?domain=example.com"

GET /site/manifest Web app manifest

The PWA manifest, validated for installability.

Parameter	Required	Description
`url`	yes	Full URL including https://. e.g. `https://example.com`

Cached 15 min

curl "https://a2z.tools/public-api/v1/site/manifest?url=https%3A%2F%2Fexample.com"

GET /site/service-worker Service worker

Whether the page registers a service worker.

Parameter	Required	Description
`url`	yes	Full URL including https://. e.g. `https://example.com`

Cached 15 min

curl "https://a2z.tools/public-api/v1/site/service-worker?url=https%3A%2F%2Fexample.com"

GET /site/favicon Favicons

Every favicon and touch icon the page declares, with sizes.

Parameter	Required	Description
`url`	yes	Full URL including https://. e.g. `https://example.com`

Cached 15 min

curl "https://a2z.tools/public-api/v1/site/favicon?url=https%3A%2F%2Fexample.com"

GET /site/third-party-scripts Third-party scripts

Scripts loaded from other domains, grouped by owner.

Parameter	Required	Description
`url`	yes	Full URL including https://. e.g. `https://example.com`

Cached 15 min

curl "https://a2z.tools/public-api/v1/site/third-party-scripts?url=https%3A%2F%2Fexample.com"

GET /site/external-resources External resources

Every external resource the page loads.

Parameter	Required	Description
`url`	yes	Full URL including https://. e.g. `https://example.com`

Cached 15 min

curl "https://a2z.tools/public-api/v1/site/external-resources?url=https%3A%2F%2Fexample.com"

GET /site/source-maps Exposed source maps

Publicly reachable JavaScript source maps.

Parameter	Required	Description
`url`	yes	Full URL including https://. e.g. `https://example.com`

Cached 15 min

curl "https://a2z.tools/public-api/v1/site/source-maps?url=https%3A%2F%2Fexample.com"

GET /site/dependencies Front-end dependencies

JavaScript libraries and versions detected on the page.

Parameter	Required	Description
`url`	yes	Full URL including https://. e.g. `https://example.com`

Cached 15 min

curl "https://a2z.tools/public-api/v1/site/dependencies?url=https%3A%2F%2Fexample.com"

GET /site/vulnerable-libraries Vulnerable libraries

Detected libraries with known vulnerabilities.

Parameter	Required	Description
`url`	yes	Full URL including https://. e.g. `https://example.com`

Cached 15 min

curl "https://a2z.tools/public-api/v1/site/vulnerable-libraries?url=https%3A%2F%2Fexample.com"

Your API keys

Sign in to your free A2Z Tools account to create a key. A key gives you 60 calls a minute and 2,000 a day. You can have up to 5 keys.

Fair use

Only check sites you own or have a legitimate reason to check. Don't use the API to scan the internet at large or to load-test anyone's site.
Keys that abuse the service are suspended. Limits and endpoints may change. Breaking changes come with a new version (/v2), never inside /v1.
The data is provided as is, without warranty. The terms of use and privacy policy apply. We store per-key call counts, not the domains you check.
A2Z Tools is a product of Reliable Software Technology. Questions: [email protected].