mcpField
A
api-security

api-security

github.com/transilienceaiSecurity600209 installsUpdated 13w ago
Repository

About api-security

api-security is a security testing skill for REST, GraphQL, WebSocket, and LLM-integrated APIs. It combines protocol-specific checks with fixture-driven, resumable authorization testing across large API corpora and user roles.

Key features

  1. 01REST, GraphQL, WebSocket, and Web-LLM testing
  2. 02Endpoint discovery and authentication mapping
  3. 03Fixture generation from API corpora
  4. 04Role-based authorization replay
  5. 05Evidence logs and resumable test runs

Use cases

  1. 01Testing API endpoints for access-control flaws
  2. 02Replaying authorization checks across many API operations
  3. 03Assessing Web-LLM APIs for injection and data exposure
  4. 04Capturing request and response evidence

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/transilienceai/communitytools --skill api-security

After installing, type/api-securityin Claude Code to confirm it loaded.

Bundled files

References and scripts installed along with SKILL.md.

reference/
api-security-principles.md
graphql-resources.md
INDEX.md
owasp-api-top10-coverage.md
reference/scenarios/graphql/
auth-bypass-and-injection.md
csrf-and-content-type.md
dos-and-batching.md
endpoint-discovery.md
idor-and-mass-enumeration.md
introspection-and-bypass.md
rate-limit-bypass.md
schema-reconstruction.md
reference/scenarios/mcp/
inspector-stdio-rce.md
reference/scenarios/rest/
api-recon-and-discovery.md
cognito-unauth-and-srp.md
content-type-confusion-xxe.md
cors-misconfiguration.md
exposed-documentation.md
https-downgrade-redirect-hsts.md
mass-assignment.md
mattermost-slash-command-dialog-hijack.md
odata-deep-authz.md
options-method-enumeration.md
owasp-bola-bopla.md
sspp-query-string.md
sspp-rest-path.md
unauth-existence-oracle.md
unauthenticated-webhook-oracle.md
verbose-error-schema-disclosure.md
waf-bypass-techniques.md

Details

From the project README

API Security

Test API endpoints for security vulnerabilities across REST, GraphQL, WebSocket, and LLM-integrated APIs.

Techniques

TypeKey Vectors
GraphQLIntrospection, batching attacks, nested query DoS, field suggestion
REST APIBOLA/IDOR, mass assignment, rate limiting, auth bypass, versioning
WebSocketCross-site hijacking, message manipulation, auth flaws
Web-LLMPrompt injection via API, excessive agency, data exfiltration

Workflow

  1. Discover API endpoints and documentation (Swagger, GraphQL schema)
  2. Map authentication and authorization mechanisms
  3. Test per API type using appropriate techniques
  4. Validate data exposure and access control flaws
  5. Capture evidence with HTTP request/response logs

API at scale (offline corpus / fixture-driven)

For a large or offline API surface — a 2000+ path Swagger, a Postman corpus, a HAR capture — do NOT hand-build the coverage machinery per engagement. Drive it deterministically:

  1. Ingest the corpus → per-endpoint fixtures: python3 tools/fixture_ingest.py <openapi|postman|har> -o fixtures.json normalizes every operation into a request template (method, url with path params filled, sampled body, object_ref for id-like path params, security requirement) and STRIPS baked-in auth (the harness injects tokens). This is what turns a large (thousands-of-operations) OpenAPI/Postman corpus into a resumable matrix instead of an untested pile.
  2. Acquire per-role sessions: via authenticated-session-acquisition (MFA/OTP/SRP → reusable tokens) into the harness's token store.
  3. Replay the per-role authz matrix: python3 tools/auth_replay_harness.py --requests fixtures.json --tokens tokens.json [--proxy <vantage>] replays every endpoint under every role (and cross-tenant), flags BOLA/BFLA where a role got authorized on an object/action it should not, and logs an evidence_id per (endpoint × role). Egress-route via the provisioned vantage for allowlisted APIs.
  4. Protocol-specific authz: OData (odata-deep-authz.md), Cognito (cognito-unauth-and-srp.md), authenticated WebSocket (authenticated-per-role-authz.md).

The batch is resumable (checkpoint the harness results) so flapping auth never zeroes the run — the recurring at-scale gap. Run the FULL matrix so a clean result is an evidenced negative, not an untested surface.

Reference

  • reference/graphql*.md - GraphQL attack techniques and labs
  • reference/scenarios/rest/*.md - REST API security testing (BOLA/BOPLA, mass assignment, SSPP, content-type confusion)
  • reference/websockets*.md - WebSocket vulnerability testing
  • reference/web-llm*.md - Web-LLM attack techniques and labs

Comments

Markdown supported