{"success":true,"apiVersion":"1","description":"Public agent-executable Vigilbase security tools. These endpoints run non-intrusive checks without Turnstile or email verification. Intrusive scanners (website-security, react2shell) and sensitive lookups (fortibleed-check) run in the browser with email verification, or through Vigilbase One with a signed-in CLI (`npx @vigilbase/cli login`) — see agent skills.","openapi":"https://vigilbase.com/openapi.json","docsUrl":"https://docs.vigilbase.com/tools/developers","skillsIndex":"https://vigilbase.com/.well-known/agent-skills/index.json","tools":[{"toolName":"security-headers","name":"HTTP Security Headers Checker","description":"Fetch a URL's HTTP response headers and grade them against the OWASP Secure Headers Project.","targetDescription":"Full URL or domain to fetch (https:// is assumed when a scheme is omitted).","uiUrl":"https://vigilbase.com/tools/security-headers","skillUrl":"https://vigilbase.com/agent-skills/security-headers.md","executeUrl":"https://vigilbase.com/api/v1/agent/tools/security-headers/execute"},{"toolName":"email-security","name":"Email Security Analyzer","description":"Inspect public DNS email authentication records (SPF, DKIM, DMARC, MX, DNSSEC, MTA-STS, TLS-RPT) and return an A–F grade.","targetDescription":"Apex or mail domain to check, e.g. example.com.","uiUrl":"https://vigilbase.com/tools/email-security","skillUrl":"https://vigilbase.com/agent-skills/email-security.md","executeUrl":"https://vigilbase.com/api/v1/agent/tools/email-security/execute"}],"auth":{"anonymousScopes":["tools:read","tools:execute","badges:read"],"developerKeyScopes":["tools:read","tools:execute","badges:read"],"header":"Authorization: Bearer <api_key> or X-Api-Key: <api_key>","manageKeys":"https://one.vigilbase.com/developers"},"rateLimit":{"windowSeconds":60,"maxRequests":10,"tier":"anonymous","scope":"per client IP (durable across isolates)","scanQuota":{"windowSeconds":3600,"maxScansPerClientIp":20,"maxScansPerTarget":20,"maxScansOverall":300,"scope":"per client IP, per target and overall, with or without an API key; a spent quota returns 429 with Retry-After"}}}