Linux System Call Lookup Site and API Update: Multi-Architecture Support and Kernel Selector Added

From 2020 to 2026: The Continuous Evolution of a Developer Tool

A developer announced an update to their Linux system call (syscall) lookup website and API on Hacker News. The project was initially released in 2020, and this update brings several practical improvements: support for more architectures, a kernel selector, system call descriptions, and other convenience features. The author openly admits they are not a CSS expert, but the new version offers an improved experience on mobile devices.

The project received 197 points and 48 comments on Hacker News, indicating genuine demand within the developer community for syscall lookup tools. For those working in low-level development, security research, or operating system studies, quickly looking up how a particular system call behaves across different architectures and kernel versions is a frequent and tedious task.

System calls (syscalls) are the controlled entry points that the operating system kernel provides to user-space programs. Through them, programs request privileged operations such as file I/O, memory mapping, and process creation. In Linux, each system call has a fixed number and parameter convention, but the call numbers may differ across instruction set architectures (e.g., x86_64, ARM64, RISC-V), and kernel version iterations may add or remove calls or change parameter semantics. Therefore, developers often need to cross-check call numbers and behavior across architectures and versions, and manually consulting man pages and source code is quite tedious—this is exactly where aggregation lookup tools like syscall.sh provide value.

Core Updates: Multi-Architecture and Kernel Selector

The focus of this update is expanding coverage. When the original author first released it in 2020, it may have supported only a limited set of architectures. Now, with support for more architectures, developers can query system call information across different instruction set architectures such as x86 and ARM on the same platform.

The addition of the kernel selector is equally important. Linux kernel versions iterate frequently, and syscall numbers, parameters, and behavior may change between versions. With the kernel selector, users can specify a target kernel version to obtain more precise reference information. For driver developers or embedded engineers who need compatibility with specific kernel versions, this can save considerable time spent digging through source code.

The addition of system call descriptions lowers the barrier to entry. A bare list of call numbers is not very friendly to newcomers; with descriptions, developers can more quickly understand the purpose of each system call.

The kernel selector addresses the issue that the Linux syscall interface is not entirely stable. The kernel adds new calls (such as those related to io_uring), deprecates old ones, and adjusts parameter structures, and syscall numbers may also differ across architectures. If a tool only shows data for the latest version, driver developers or embedded engineers targeting older kernels may get incorrect information. Allowing a kernel version to be specified means query results can correspond to the real ABI, reducing debugging costs caused by version mismatches and enabling the tool to serve scenarios involving long-term maintenance of older systems.

API Access: From Web Pages to Automated Integration

In addition to the website, the author also provides an API endpoint (api.syscall.sh). This extends the tool from "manual lookup" to a "programmable data source." Security researchers can write scripts to batch-fetch syscall lists for building detection rules; tool developers can integrate it into IDE plugins or documentation generation workflows.

A stable API means the project is not just a personal toy but has the potential to become part of the infrastructure. However, whether the API can be more widely adopted will depend on its stability, rate limits, and the completeness of its data structure documentation.

An API (Application Programming Interface) here refers to an interface that returns syscall data in a fixed format over HTTP. Compared with manually browsing web pages, an API allows the tool to be invoked by scripts, IDE plugins, or documentation generation workflows, enabling batch fetching and automated processing. For security research, it can be used to build syscall whitelists or detection rules; for tool developers, it can be embedded as a data source in their own workflows. However, whether the API is widely adopted also depends on its stability, rate-limiting strategy, and whether the data field documentation is clear.

Mobile Adaptation and Developer Experience

The author mentions that the website now "works a bit better" on mobile devices but humbly states they are not a CSS expert. This reflects a common phenomenon: developer tools are often built by people from backend or systems backgrounds, and frontend experience is a weak spot. For lookup tools, the value of mobile adaptation lies in checking details during fragmented time—for example, quickly confirming a syscall detail during a meeting or on a commute.

Judging from community feedback (197 points, 48 comments), although such foundational tools are not flashy, they hit real pain points. System calls are the cornerstone of the Linux ecosystem, and information retrieval tools around them are worth continuous refinement.

Why This Kind of Tool Deserves Attention

Syscall lookup may seem niche, but its impact is broad. Students taking operating systems courses need it to compare with theory; CTF players and vulnerability researchers need it to construct exploit chains; performance engineers need it to trace program behavior. A lookup site that aggregates multiple architectures, multiple kernel versions, descriptions, and an API can replace a great deal of scattered man page consultation and source code searching.

The project's update cadence also shows that the maintainer is willing to invest over the long term. For open-source tools, continuous updates are themselves a quality signal. If you frequently work with Linux at a low level, you might want to bookmark it or try using the API to integrate syscall data into your own workflow.

One-line Summary

Linux syscall lookup site syscall.sh updated with multi-architecture support, kernel selector, descriptions, and API.

Paragraph Summary

A developer announced on Hacker News an update to a Linux system call lookup website and API, originally released in 2020. The update adds support for more architectures, a kernel selector, syscall descriptions, and improves the mobile experience. The kernel selector lets users specify a kernel version for precise information, while the API extends the tool into a programmable data source. The article notes that although syscall lookup is niche, its impact is broad, with frequent demand from students, CTF players, vulnerability researchers, and performance engineers, and that continuous updates are themselves a quality signal for open-source tools.