Tool consolidation
One scan replaces 17 point tools
The point-tool stack most teams maintain quarter to quarter, folded into one 60-second scan with a 0-1000 TrustScore and a copy-paste fix for every issue. Nothing on this page is a roadmap claim - each row maps to a check that runs today, plus the registry block that covers it.
| Capability | Typical point tools | In Vysiro |
|---|---|---|
| DMARC report parsing + policy monitoring | EasyDMARC, Dmarcian | Reads your DMARC record, scores policy strength, parses aggregate XML reports inline. DMARC category (T-class), DMARC RUA tool |
| DNS records + blacklist lookup | MxToolbox | Full DNS resolution across 5 DoH resolvers, RBL cross-check on every MX host. DNS + IP Reputation categories |
| TLS / SSL grade | SSL Labs | Cipher + protocol grading on every scan, no separate report to run. SSL/TLS category |
| Security headers grade | SecurityHeaders.com | CSP, HSTS, X-Frame-Options, Referrer-Policy scored in the same call. Security Headers category |
| SPF record validation + flattening | autospf | Lookup count, mechanism order, recommended flattening surfaced as a Fix It issue. SPF category + SPF Flattener tool |
| DNSSEC verification | Verisign DNSSEC Debugger | DNSSEC chain validated end-to-end on each scan. DNSSEC category |
| BIMI record + VMC readiness | BIMI Group inspector | BIMI presence, logo URL, VMC link checked alongside DMARC enforcement. BIMI category |
| MTA-STS + TLS-RPT compliance | Hardenize, aykira | Policy file fetched, version parsed, TLS-RPT endpoint validated. MTA-STS + TLS-RPT categories |
| Certificate Transparency log search | crt.sh, Cert Spotter | CT log tail on every scan; subdomain inventory surfaces orphan certs. Certificate Lifecycle category + CT Log tool |
| Typosquatting / lookalike detection | dnstwist | Generates and resolves common permutations to flag live impersonators. Brand Integrity category |
| IP reputation / blacklist scoring | Spamhaus, Barracuda RBL | Multi-RBL lookup with graduated scoring (1, 2-3, 4+ list hits). IP Reputation category |
| Subdomain takeover scanning | nuclei takeover templates | 8 dedicated takeover checks covering S3, Heroku, GitHub Pages, etc. Subdomain Takeover block (TAKEOVER_001-008) |
| Expiry Guard: cert, chain, DNSSEC + VMC expiry monitoring | TrackSSL, UptimeRobot SSL, StatusCake | One daily monitor watches every silent-expiry failure mode: leaf certificate, intermediate CA chain, DNSSEC RRSIG signatures, and the BIMI VMC behind your verified logo. Alerts at 30 / 14 / 7 days before each notAfter, with an auto-renew-aware downgrade so ACME certs do not spam. Certificate Lifecycle + DNSSEC + BIMI categories, via expiry-guard.ts + /api/cron/cert-expiry |
| Uptime / availability monitoring + downtime alerts | UptimeRobot, StatusCake, Better Stack | Periodic HTTPS check, status-change alerts via email / webhook. Edge availability and resolver health rolled into the same monitor. Edge Hosting + DNS Resilience + /api/cron/uptime |
| WHOIS + domain-expiry monitoring + alerts | WhoisJSON, whois.com, Uptime.com | Daily RDAP / WHOIS check with 30 / 14 / 7 / 1 day expiry alerts. Catches the disaster nobody ever monitors until it happens. Domain Hygiene category + /api/cron/whois-expiry |
| DNS change monitoring + drift alerts | DNS Spy, Domain Monitor | Scheduled re-scan diffs DNS records (A / MX / NS / TXT) and fires drift alerts. CT-log tail catches new cert issuance within ~60 seconds. Scheduled re-scan + /api/cron/dns-drift |
| MCP / llms.txt exposure | (none - greenfield) | llms.txt audit + MCP endpoint discovery + auth-header probe ship today; deeper MCP coverage staged in the registry. Agent Readiness category (live); MCP block (MCP_001-025) staged in the registry |