# SuperStack

> SuperStack is a small senior DevOps and software engineering team in South Africa. These free tools are pages and JSON APIs: South African tax estimates and dates, public holidays, rand reference rates, and checks for mail, DNS, TLS and websites. They do not ask for cloud credentials and they do not store what you submit, apart from an anonymous count.

## Tools

- [Email domain health check for SPF and DKIM](https://superstack.co.za/tools/email-domain-health): SPF, DKIM, DMARC, MX, MTA-STS and BIMI, explained in plain language with a grade and a fix for each gap. JSON: POST https://superstack.co.za/api/tools/email-health with domain.
- [Website safety and speed scan](https://superstack.co.za/tools/website-scan): HTTPS, TLS, security headers, redirects and basic SEO tags. A PageSpeed score is included when the server has a key. JSON: POST https://superstack.co.za/api/tools/website-scan with url.
- [AWS bill sanity check for common waste](https://superstack.co.za/tools/aws-bill-check): A checklist for idle servers, NAT gateways, old snapshots, unattached addresses and missing savings plans. No AWS login. JSON: POST https://superstack.co.za/api/tools/aws-bill with the fields in the OpenAPI document.
- [DNS lookup, nameservers and domain expiry](https://superstack.co.za/tools/dns-lookup): Records, nameservers, registrar and expiry from the public registration data, and a hint when two resolvers disagree. JSON: POST https://superstack.co.za/api/tools/dns-lookup with domain.
- [SSL certificate expiry and chain checker](https://superstack.co.za/tools/ssl-check): Issuer, expiry, chain and how many days are left on the certificate. JSON: POST https://superstack.co.za/api/tools/ssl-check with host.
- [HTTP header and redirect chain checker](https://superstack.co.za/tools/http-headers): The redirect chain and the response headers on each hop. Cookie values are hidden. JSON: POST https://superstack.co.za/api/tools/http-headers with url.
- [Kubernetes YAML linter for common mistakes](https://superstack.co.za/tools/kubernetes-lint): Flags missing resource limits, latest tags, privileged containers and missing probes. The file is not stored. JSON: POST https://superstack.co.za/api/tools/kubernetes-lint with yaml.
- [Cron expression explainer in South African time](https://superstack.co.za/tools/cron): What a cron expression means, and the next run times. The default timezone is Africa/Johannesburg. JSON: POST https://superstack.co.za/api/tools/cron with expression.
- [Agent-readiness check for robots and llms.txt](https://superstack.co.za/tools/agent-ready): Robots, llms.txt, sitemap, structured data and an OpenAPI document, with a plain-language grade. JSON: POST https://superstack.co.za/api/tools/agent-ready with url.
- [PAYE and UIF salary calculator for South Africa](https://superstack.co.za/tools/paye-calculator): Monthly PAYE, UIF and a rough take-home figure from the current SARS individual tables. JSON: POST https://superstack.co.za/api/tools/paye with pay.
- [VAT calculator at the South African rate](https://superstack.co.za/tools/vat-calculator): Add 15% VAT to an amount, or pull the VAT out of a VAT-inclusive amount. JSON: POST https://superstack.co.za/api/tools/vat with amount.
- [Freelancer rate calculator in rand](https://superstack.co.za/tools/freelancer-rate): A daily and hourly rate in rand from a target income, leave and South African public holidays. JSON: POST https://superstack.co.za/api/tools/freelancer-rate with target.
- [South African provisional tax dates](https://superstack.co.za/tools/provisional-tax-dates): The three provisional tax dates for a year-end, shifted off weekends and public holidays. JSON: POST https://superstack.co.za/api/tools/provisional-tax with the fields in the OpenAPI document.
- [South African public holidays](https://superstack.co.za/tools/sa-public-holidays): The year’s public holidays and how many business days that leaves. JSON: POST https://superstack.co.za/api/tools/sa-holidays with the fields in the OpenAPI document.
- [South African business-day counter](https://superstack.co.za/tools/business-days): How many business days fall between two dates, and which public holidays sit in that range. JSON: POST https://superstack.co.za/api/tools/business-days with from, to.
- [Rand exchange rates from the ECB reference](https://superstack.co.za/tools/zar-exchange-rates): A dated rand reference rate against major currencies. Not the rate a bank will give you. JSON: POST https://superstack.co.za/api/tools/zar-rates with the fields in the OpenAPI document.
- [AWS EKS and EC2 on-demand cost estimate](https://superstack.co.za/tools/eks-cost): A dated on-demand estimate for an EKS control plane and a small EC2 node group. JSON: POST https://superstack.co.za/api/tools/eks-cost with the fields in the OpenAPI document.
- [Terraform plan explainer](https://superstack.co.za/tools/terraform-plan): What a plan will create, change, replace or destroy, without echoing resource values. JSON: POST https://superstack.co.za/api/tools/terraform-plan with the fields in the OpenAPI document.
- [Dockerfile checker](https://superstack.co.za/tools/dockerfile-check): A short check for the Dockerfile mistakes that show up in reviews. JSON: POST https://superstack.co.za/api/tools/dockerfile with the fields in the OpenAPI document.
- [IPv4 CIDR and subnet calculator](https://superstack.co.za/tools/cidr): The network, broadcast, mask and usable hosts for an IPv4 CIDR. JSON: POST https://superstack.co.za/api/tools/cidr with cidr.
- [JSON and YAML formatter](https://superstack.co.za/tools/json-yaml): Validate JSON or YAML and show it indented. Invalid documents return the parser error. JSON: POST https://superstack.co.za/api/tools/json-yaml with the fields in the OpenAPI document.
- [JWT decoder that stays in the browser](https://superstack.co.za/tools/jwt): Header, payload and expiry, decoded on this page only. Not a verification. JSON: POST https://superstack.co.za/api/tools/jwt with the fields in the OpenAPI document.
- [Password safety guide and generator](https://superstack.co.za/tools/password): A local password generator and a short guide. The API returns the policy and an entropy estimate, never a password. JSON: POST https://superstack.co.za/api/tools/password with the fields in the OpenAPI document.
- [QR code maker for a link or a short note](https://superstack.co.za/tools/qr-code): An SVG QR code for a URL or a short note. The text is not stored. JSON: POST https://superstack.co.za/api/tools/qr with text.
- [Is this email a scam? A cautious check](https://superstack.co.za/tools/email-scam): Heuristics on the pasted text, plus MX, SPF and DMARC for the sender domain. Not a verdict, and not stored. JSON: POST https://superstack.co.za/api/tools/email-scam with text.

## For automated clients

- OpenAPI: https://superstack.co.za/api/tools
- Machine-readable list: https://superstack.co.za/.well-known/ai-tools.json
- Human pages start at https://superstack.co.za/tools
- Rate limit: 8 requests per 10 minutes for each tool, per network.
- Send JSON. Do not send API keys, passwords or cloud credentials. Those fields are rejected.
- Other paths under /api/ are private and are not part of this list.

## Optional next step

If a result needs a person, the AWS account review is at https://superstack.co.za/aws-review and the second-opinion review is at https://superstack.co.za/aws-review#free-review.