Heads up This site is currently under heavy development.

For Researcher & Business subscribers

API

Everything on this site, queryable — filter releases across the whole watchlist, pull a tool's SBOM or captured CLI examples directly, read the analytics charts as data instead of pixels. 15 endpoints, versioned under /v1/.

Not the same thing as the free RSS/OPML feeds — those need no key and stay free. This is the deeper layer: real filtering and search, analytics with the names left in, and tool-level data the feeds don't carry at all.

Subscribe to Researcher Already a subscriber? Generate a key →

Getting started

Generate a key from your account page — it's shown once, so store it when you make it. Send it as x-api-key on every request; there's no Authorization header here, since CloudFront's origin signing overwrites it before it would reach the API.

The base path carries the version (/v1/) — a breaking change gets /v2/ rather than changing what's already there out from under a running script. Each key gets its own daily rate limit, generous enough for a full daily sync across the whole watchlist; going over it returns 429 until the rolling window resets. A missing or revoked key gets 401.

curl 
export API_KEY=ctk_your_key_here

curl -H "x-api-key: $API_KEY" \
  https://d3hvv6ete0783d.cloudfront.net/v1/tools/count

Tools

4 endpoints

The watchlist itself — what's tracked, what each tool is, and what it has shipped.

GET /v1/tools/count any key

Just the number — for a status badge or a monitoring check that shouldn't have to page through the full list.

Query parameters

NameTypeDescription
category / license / tool_type—Same filters as /v1/tools, for a scoped count instead of the total.

Example

curl 
curl -H "x-api-key: $API_KEY" \
  https://d3hvv6ete0783d.cloudfront.net/v1/tools/count
200 OK 
{
  "total": 836,
  "generated_at": "2026-08-14"
}
{2 keys}
"total": 836,
"generated_at": "2026-08-14"
GET /v1/tools any key

Every tracked tool, with the metadata already published on the tools page.

Query parameters

NameTypeDescription
categorystringTaxonomy slug, e.g. cloud-security.
licenseenumopen-source or commercial.
tool_typeenumcli / service / library / gui / rules / other.
qstringMatches tool name or vendor.
cursor / limitstring / intPagination. Default limit 50, max 200.

Example

curl 
curl -H "x-api-key: $API_KEY" \
  "https://d3hvv6ete0783d.cloudfront.net/v1/tools?limit=2"
200 OK 
{
  "tools": [
    {
      "name": "Nmap",
      "display": "Nmap",
      "category": "reconnaissance",
      "vendor": null,
      "tool_type": "cli",
      "tags": [
        "network-scanning",
        "port-scanning",
        "service-detection",
        "os-fingerprinting"
      ],
      "repo": "nmap/nmap",
      "url": null,
      "docs_url": "https://nmap.org/book/man.html",
      "changelog_url": "https://nmap.org/changelog.html",
      "website": null,
      "adapter": "github",
      "open_source": null,
      "license": "oss",
      "launched": null,
      "added": "2026-06-24",
      "retired": false,
      "slug": "nmap"
    },
    {
      "name": "Falco",
      "display": "Falco",
      "category": "runtime-security",
      "vendor": null,
      "tool_type": "service",
      "tags": [
        "ebpf",
        "runtime-detection",
        "syscall-monitoring",
        "kubernetes"
      ],
      "repo": "falcosecurity/falco",
      "url": null,
      "docs_url": "https://falco.org/docs/",
      "changelog_url": "https://falco.org/docs/reference/changelog/",
      "website": null,
      "adapter": "github",
      "open_source": null,
      "license": "oss",
      "launched": null,
      "added": "2026-07-02",
      "retired": false,
      "slug": "falco"
    }
  ],
  "total": 2,
  "next_cursor": null
}
{3 keys}
"tools":
[2 items]
{18 keys}
"name": "Nmap",
"display": "Nmap",
"category": "reconnaissance",
"vendor": null,
"tool_type": "cli",
"tags":
[4 items]
"network-scanning",
"port-scanning",
"service-detection",
"os-fingerprinting"
,
"repo": "nmap/nmap",
"url": null,
"docs_url": "https://nmap.org/book/man.html",
"changelog_url": "https://nmap.org/changelog.html",
"website": null,
"adapter": "github",
"open_source": null,
"license": "oss",
"launched": null,
"added": "2026-06-24",
"retired": false,
"slug": "nmap"
,
{18 keys}
"name": "Falco",
"display": "Falco",
"category": "runtime-security",
"vendor": null,
"tool_type": "service",
"tags":
[4 items]
"ebpf",
"runtime-detection",
"syscall-monitoring",
"kubernetes"
,
"repo": "falcosecurity/falco",
"url": null,
"docs_url": "https://falco.org/docs/",
"changelog_url": "https://falco.org/docs/reference/changelog/",
"website": null,
"adapter": "github",
"open_source": null,
"license": "oss",
"launched": null,
"added": "2026-07-02",
"retired": false,
"slug": "falco"
,
"total": 2,
"next_cursor": null
GET /v1/tools/{slug} any key

One tool in full, including its most recent release.

Parameters

NameTypeDescription
slugpathSame slug the site uses at /tools/{slug}.

Example

curl 
curl -H "x-api-key: $API_KEY" \
  https://d3hvv6ete0783d.cloudfront.net/v1/tools/nmap
200 OK 
{
  "name": "Nmap",
  "display": "Nmap",
  "category": "reconnaissance",
  "vendor": null,
  "tool_type": "cli",
  "tags": [
    "network-scanning",
    "port-scanning",
    "service-detection",
    "os-fingerprinting"
  ],
  "repo": "nmap/nmap",
  "url": null,
  "docs_url": "https://nmap.org/book/man.html",
  "changelog_url": "https://nmap.org/changelog.html",
  "website": null,
  "adapter": "github",
  "open_source": null,
  "license": "oss",
  "launched": null,
  "added": "2026-06-24",
  "retired": false,
  "slug": "nmap",
  "latest_release": {
    "tool": "Nmap",
    "category": "reconnaissance",
    "version": "commits-2026-07-11",
    "published_at": "2026-08-09T22:03:18+00:00",
    "url": "https://github.com/nmap/nmap/compare/49a85f9c3c11...115af39aacf9",
    "summary": "Nmap gains TLS close_notify tolerance, SSL service portrule coverage, and signal propagation to child processes with `-k`.",
    "feature_bullets": [
      "Adds `-k` signal propagation: termination signals (INT/TERM/HUP) are now caught and forwarded to the entire process group, then Ncat exits with `128 + signum`.",
      "NSE scripts now include `s` (SSL-protected) service names in their portrules, so scripts run against SSL-wrapped services too.",
      "Nmap now tolerates TLS peers that do not send `close_notify`, preventing spurious scan failures against non-compliant TLS targets.",
      "`http-referer-checker` now categorizes but does not fetch off-host URLs, limiting requests to the target host only."
    ],
    "breaking_changes": [],
    "usage_examples": [
      {
        "description": "Specify an interface with -e to bind both the outgoing interface and the source address.",
        "command": "nmap -e eth1 -S 192.168.1.50 <target>",
        "language": "",
        "kind": "shell"
      }
    ],
    "signal_kind": "activity",
    "prerelease": false,
    "is_latest": false
  },
  "has_api_surface": false,
  "has_cli_surface": true
}
{21 keys}
"name": "Nmap",
"display": "Nmap",
"category": "reconnaissance",
"vendor": null,
"tool_type": "cli",
"tags":
[4 items]
"network-scanning",
"port-scanning",
"service-detection",
"os-fingerprinting"
,
"repo": "nmap/nmap",
"url": null,
"docs_url": "https://nmap.org/book/man.html",
"changelog_url": "https://nmap.org/changelog.html",
"website": null,
"adapter": "github",
"open_source": null,
"license": "oss",
"launched": null,
"added": "2026-06-24",
"retired": false,
"slug": "nmap",
"latest_release":
{12 keys}
"tool": "Nmap",
"category": "reconnaissance",
"version": "commits-2026-07-11",
"published_at": "2026-08-09T22:03:18+00:00",
"url": "https://github.com/nmap/nmap/compare/49a85f9c3c11...115af39aacf9",
"summary": "Nmap gains TLS close_notify tolerance, SSL service portrule coverage, and signal propagation to child processes with `-k`.",
"feature_bullets":
[4 items]
"Adds `-k` signal propagation: termination signals (INT/TERM/HUP) are now caught and forwarded to the entire process group, then Ncat exits with `128 + signum`.",
"NSE scripts now include `s` (SSL-protected) service names in their portrules, so scripts run against SSL-wrapped services too.",
"Nmap now tolerates TLS peers that do not send `close_notify`, preventing spurious scan failures against non-compliant TLS targets.",
"`http-referer-checker` now categorizes but does not fetch off-host URLs, limiting requests to the target host only."
,
"breaking_changes": [],
"usage_examples":
[1 item]
{4 keys}
"description": "Specify an interface with -e to bind both the outgoing interface and the source address.",
"command": "nmap -e eth1 -S 192.168.1.50 <target>",
"language": "",
"kind": "shell"
,
"signal_kind": "activity",
"prerelease": false,
"is_latest": false
,
"has_api_surface": false,
"has_cli_surface": true
GET /v1/tools/{slug}/releases any key

One tool's release history.

Parameters

NameTypeDescription
slugpathRequired.
since / untildateISO date bounds on published_at.
cursor / limitstring / intPagination.

Releases

1 endpoint

Every release across the watchlist in one feed — what Tail sends, queryable instead of mailed.

GET /v1/releases any key

Filterable across the whole watchlist, not just one tool.

Query parameters

NameTypeDescription
toolsstring[]Comma-separated slugs.
categoriesstring[]Comma-separated taxonomy slugs.
since / untildateISO date bounds.
cursor / limitstring / intPagination. Default limit 50, max 200.

Categories

1 endpoint

The taxonomy every category filter on the site already uses.

GET /v1/categories any key

Every category, with a live tool count.

Newsletter issues

3 endpoints

The published archive — daily, highlights, and docs-weekly.

GET /v1/issues any key

The issue index.

Query parameters

NameTypeDescription
seriesenumdaily / highlights / docs-weekly.
cursor / limitstring / intPagination, newest first.
GET /v1/issues/{issue} any key

One issue in full — the same entries the site renders, as JSON.

Parameters

NameTypeDescription
issuepathIssue number, e.g. 044, or docs-006 / highlights-006.
GET /v1/issues/{issue}/download any key

The same issue as a file — JSON, or a standalone HTML page.

Parameters

NameTypeDescription
issuepathRequired.
formatenumRequired. json or html.

Tool APIs

1 endpoint

What a tracked tool's own API looks like, for the tools that publish one.

GET /v1/tools/{slug}/api any key

Capability areas, endpoint count, and the most recent spec change.

Parameters

NameTypeDescription
slugpathRequired.

Code & supply chain

3 endpoints

What we learned by actually running a tool and reading its repo.

GET /v1/tools/{slug}/cli any key

Captured command-line examples, with what they actually printed.

Parameters

NameTypeDescription
slugpathRequired.
GET /v1/tools/{slug}/sbom any key

The tool's software bill of materials.

Parameters

NameTypeDescription
slugpathRequired.
GET /v1/tools/{slug}/surface any key

Language mix, dependencies, and AI-attribution stats.

Parameters

NameTypeDescription
slugpathRequired.

Analytics

1 endpoint

The charts behind /analytics, as data.

GET /v1/analytics/{chart} researcher+

One chart, full detail for Researcher and Business — masked names for everyone else, same rule as the page.

Parameters

NameTypeDescription
chartpathvelocity, notes_quality, investment, momentum, and the rest of the published set.

Examples

curl · practitioner-tier key 
curl -H "x-api-key: $API_KEY" \
  https://d3hvv6ete0783d.cloudfront.net/v1/analytics/notes_quality
200 OK · withheld 
{
  "chart": "notes_quality",
  "withheld": true,
  "data": {
    "tools": [
      {
        "name": "▒▒▒▒▒▒▒",
        "display": "▒▒▒▒▒▒▒",
        "category": "container-security",
        "open_source": true,
        "adapter": "github",
        "corpus": "github",
        "channel": "release",
        "channels_scored": [
          "release"
        ],
        "release_feed_empty": false,
        "score": 87,
        "depth": 47.5,
        "examples": 35,
        "transparency": 4.5,
        "notes_scored": 4,
        "zero_body_notes": 0,
        "truncated_excluded": 0,
        "bodyless_feed_items_skipped": 0
      }
    ]
  }
}
{3 keys}
"chart": "notes_quality",
"withheld": true,
"data":
{1 key}
"tools":
[1 item]
{17 keys}
"name": "▒▒▒▒▒▒▒",
"display": "▒▒▒▒▒▒▒",
"category": "container-security",
"open_source": true,
"adapter": "github",
"corpus": "github",
"channel": "release",
"channels_scored":
[1 item]
"release"
,
"release_feed_empty": false,
"score": 87,
"depth": 47.5,
"examples": 35,
"transparency": 4.5,
"notes_scored": 4,
"zero_body_notes": 0,
"truncated_excluded": 0,
"bodyless_feed_items_skipped": 0
curl · researcher-tier key 
curl -H "x-api-key: $API_KEY" \
  https://d3hvv6ete0783d.cloudfront.net/v1/analytics/notes_quality
200 OK · full detail 
{
  "chart": "notes_quality",
  "withheld": false,
  "data": {
    "tools": [
      {
        "name": "dockerscan",
        "display": "dockerscan",
        "category": "container-security",
        "open_source": true,
        "adapter": "github",
        "corpus": "github",
        "channel": "release",
        "channels_scored": [
          "release"
        ],
        "release_feed_empty": false,
        "score": 87,
        "depth": 47.5,
        "examples": 35,
        "transparency": 4.5,
        "notes_scored": 4,
        "zero_body_notes": 0,
        "truncated_excluded": 0,
        "bodyless_feed_items_skipped": 0
      }
    ]
  }
}
{3 keys}
"chart": "notes_quality",
"withheld": false,
"data":
{1 key}
"tools":
[1 item]
{17 keys}
"name": "dockerscan",
"display": "dockerscan",
"category": "container-security",
"open_source": true,
"adapter": "github",
"corpus": "github",
"channel": "release",
"channels_scored":
[1 item]
"release"
,
"release_feed_empty": false,
"score": 87,
"depth": 47.5,
"examples": 35,
"transparency": 4.5,
"notes_scored": 4,
"zero_body_notes": 0,
"truncated_excluded": 0,
"bodyless_feed_items_skipped": 0

Search

1 endpoint

One query box over tools and releases.

Coming later

2 endpoints

Designed, not live yet.

GET /v1/tools/{slug}/doc-diffs researcher+

Full documentation and API-reference diffs — what Diff subscribers get by email today.

GET /v1/corpus/export business

Bulk export of the underlying source→summary training pairs.

Questions or something not behaving as documented — send feedback, or see the FAQ.

my-toolchain — 0 tools
paste an install list to detect your tools

A brew list, a Brewfile, requirements.txt, a Dockerfile — or just the product names, free-form. Nothing leaves your browser.

    browse all tools →