TLS Version Support Scan
Probe a server's TLS configuration: which protocol versions (TLS 1.0 → 1.3) it accepts, the cipher negotiated for each, and a downgrade-risk verdict. Legacy protocols still accepting connections are flagged — weak TLS is a compliance finding agents get asked about.
🔌 Server-side tool
This tool runs on the server (it fetches third-party URLs directly and cannot run in your browser). Use the paid JSON API below — the worked examples show real server-side results and refresh automatically.
Worked examples
This site
GET /api/v1/security/tls-versions?domain=agentstoolshub.com
Result: agentstoolshub.com: TLSv1.2, TLSv1.3 accepted — ✓ No legacy protocols — minimum TLS 1.2 enforced
A major bank
GET /api/v1/security/tls-versions?domain=chase.com
Result: chase.com: TLSv1.2, TLSv1.3 accepted — ✓ No legacy protocols — minimum TLS 1.2 enforced
A legacy-friendly CDN
GET /api/v1/security/tls-versions?domain=cloudflare.com
Result: cloudflare.com: TLSv1.2, TLSv1.3 accepted — ✓ No legacy protocols — minimum TLS 1.2 enforced
Machine API (x402)
$0.02 / callThis tool is also a JSON API for AI agents. Requests without payment receive 402 Payment Required plus instructions; agents pay USDC on Base via the x402 protocol — no accounts, no API keys.
GET /api/v1/security/tls-versions?domain=agentstoolshub.com HTTP/1.1
Host: agentstoolshub.com
→ 402 (payment required, instructions in headers)
→ 200 (after X-PAYMENT header; JSON body below)
{
"tool": "security/tls-versions",
"input": {"domain":"agentstoolshub.com"},
"result": { "value": 2, "answer": "agentstoolshub.com: TLSv1.2, TLSv1.3 accepted — ✓ No legacy protocols — minimum TLS 1.2 enforced" }
}Agent docs: /llms.txt · OpenAPI spec · integration guide
About this tool
Live TLS protocol negotiation probes: TLS 1.0, 1.1, 1.2 and 1.3 each attempted individually against port 443, with the cipher each accepts. Legacy protocols are flagged automatically — the concrete answer to 'is this server PCI-compliant' that config files and certificates don't tell you.
Frequently asked questions
Why are TLS 1.0 and 1.1 flagged?
They're deprecated by the IETF and prohibited by PCI DSS: no forward secrecy guarantees and known downgrade attacks. Compliant servers refuse the handshake entirely — which shows as 'no'.
Does the probe try weak cipher suites too?
It reports the cipher negotiated per protocol version. Per-suite enumeration across hundreds of ciphers is a deeper scan; version support is the finding that matters most in practice.