owasp api top 10 testing agent

Features

• Filesread_file, write_file, edit_file, grep, and list_dir manage your project files inside the chat folder.
• Shellruns terminal commands like linters and tests, reporting the real exit code for success.
• Webuses web_search and http_get to read official documentation pages from the internet.
• Screenshots and imagesgen_image saves real files and ocr reads text from screenshots.
• Orchestrationtask runs parallel sub-agents and skill stores reusable playbooks for common tasks.
• Approval modesAuto-run acts at once, Ask first pauses before changes, Plan only writes plans.
• Cronruns prompts on a schedule to keep your security checks running regularly.
• Modelssupports cloud APIs, local models, or the built-in model for immediate use.

Walkthroughs

Check OWASP risks

The agent reads the OpenAPI file to list endpoints and uses grep to find route handlers in your code so it knows where to look. It checks access. It uses http_get to send requests to your staging URL. It verifies that login tokens expire correctly and checks for broken object level authorization by swapping user IDs. Api key exposure in page source is a common risk that the agent helps you identify during review. It reads error logs for leaked details and writes a report with severity levels for each finding. You review the plan in Plan only mode before accepting any changes to the working folder. This process aligns with the owasp api top 10 guidelines for securing your application programming interface.

Scan for keys

The agent uses grep to find candidate key patterns in your source files and edit_file proposes moving them to configuration with a diff in Ask first mode. You review the changes. It works locally on your Windows PC. The owasp api security top 10 guides these checks. Hardcoded api keys shipped in apps often leak secrets. No rate limit on login and otp causes issues. The agent logs all findings for your records. It keeps secrets out of shared notes and reports.