-cyan?style=flat-square){kind=icon}
Welcome to the MazAPI Security Platform. MazAPI is a comprehensive, zero-egress, multi-tier API and AI security ecosystem designed for modern development teams. It unifies pre-production static code discovery (AST App Surface), AI Agent & MCP supply-chain audits, active OWASP DAST vulnerability testing, calibrated machine learning threat detection, and an in-browser Side Panel interactive workbench.
Every component features a cohesive design system with Emerald Cyber Green and Vivid Indigo themes, built for high developer productivity and seamless CI/CD integration.
api-security/
├── api-security-project/ # Core security engines, ML pipeline, and training lab
│ ├── agent_audit/ # AI Agent security auditor, rules, & CycloneDX 1.6 AI-BOM
│ ├── app_surface/ # Multi-language AST route parsers, PR diff, & SARIF exporter
│ ├── monitoring/ # Real-time proxy, 32-feature ML model, & threat dashboard
│ ├── testing-engine/ # Active OWASP API scanner, DAST engine, & MCP auditor
│ ├── vulnerable-api/ # Port 8000 — Intentionally vulnerable FastAPI service & shop
│ ├── hardened-api/ # Port 8001 — Mitigated FastAPI service with OWASP controls
│ └── cli.py # Unified CLI for CI/CD and terminal execution
├── mazapi-extension/ # Chrome / Brave Manifest V3 Side Panel extension
├── mazapi-vscode/ # VS Code / Antigravity IDE Workspace scanner extension
└── .github/workflows/ # Automated GitHub Actions for App Surface, Agents, and MCP
Detect application, API, and IoT edge attack surfaces directly from source code during Pull Request review:
- Multi-Language AST Parsers: Native syntax tree extraction for 7 enterprise & embedded ecosystems:
- Python: FastAPI, Flask, Django REST Framework, Paho MQTT, aiocoap
- Node.js: Express, NestJS, Fastify, MQTT.js, CoAP.js
- C/C++ Embedded IoT: ESP-IDF
esp_http_server, ArduinoWebServer, FreeRTOS MQTT handlers, and micro-REST endpoints - Java: Spring Boot (
@RestController,@RequestMapping), JAX-RS - .NET: ASP.NET Core Controllers & C# Minimal APIs
- Go: Gin, Echo, Fiber, Chi
- PHP: Laravel routing & Symfony Controller attributes
- Shadow API & Undocumented Route Diffing: Compares Git commits (
--basevs--head) to pinpoint newly introduced, altered, or deprecated routes before deployment. - OpenAPI 3.0 & AsyncAPI 3.0 Synthesis: Automatically synthesizes OpenAPI 3.0 and event-driven AsyncAPI 3.0 specifications straight from code and exports findings to GitHub Code Scanning (SARIF).
Audit LLM applications, autonomous agentic workflows, and cyber-physical actuation tools before shipping to production:
- 11+ AI Frameworks Analyzed: LangChain, LangGraph, CrewAI, AutoGen, Semantic Kernel, LlamaIndex, Haystack, DSPy, OpenAI Swarm, AWS Bedrock Agents, and Custom Tool decorators.
- Deterministic Security Engines:
- Cyber-Physical IoT Actuation Guardrails: Flags AI agent tools triggering physical actuators (locks, relays, motors, valves, HVAC) executing without Human-in-the-Loop (HITL) authorization or safety parameters.
- Authorization Gaps & Confused Deputy: Detects unauthenticated tool execution sinks where unvalidated inputs invoke privileged backend tools.
- Excessive Agency: Flags unconstrained operating system shells, dynamic SQL, file writes, and financial mutation operations (e.g., Stripe charges) executing without HITL approval.
- Provider Key Exposure: Masked detection of 15+ LLM provider API credentials (OpenAI, Anthropic, Cohere, Groq, Replicate, Hugging Face).
- RAG Multi-Tenant Isolation: Flags vector database queries (Pinecone, Chroma, Qdrant, Weaviate, Pgvector) missing tenant isolation filter constraints.
- CycloneDX 1.6 AI-BOM: Generates structured AI Software Bill of Materials tracking models, parameters, data flows, and tool sinks.
Evaluate Model Context Protocol servers and IoT protocol endpoints for vulnerabilities:
- IoT API Protocol Auditor: Audits MQTT broker ACLs, CoAP UDP reflection vulnerabilities, cleartext telemetry disclosure, and insecure OTA firmware updates.
- Security Registry: Evaluates server configurations against a database of 50+ vetted community and enterprise MCP servers.
- Static Source Scans: Analyzes custom Python and Node.js MCP server implementations for shell injection and path traversal sinks.
- 32-Feature Extraction Pipeline: Measures payload size, path entropy, parameter types, authentication headers, and request timing.
- High-Accuracy Random Forest Model: Calibrated classifier delivering 99.73% validation accuracy in differentiating normal traffic from OWASP API Top 10 attacks and credential enumeration.
A persistent Chrome/Brave Side Panel workbench (Manifest V3) running 100% locally on-device:
- Passive Traffic Discovery: Automatically catalogues API routes and formats parameter templates (e.g.,
/api/users/42→/api/users/{id}). - Auth Token Harvester & JWT Inspector: Extracts Bearer tokens, cookies, and keys. Decodes JWT headers and payloads with instant alerts for
alg:nonebypasses and symmetric secret risks. - Request Manipulator & Replay (BOLA / IDOR): Live request tampering workbench with a Smart Parameter Picker for rapid authorization testing.
- Selective OAS 3.0 Export: Filter captured traffic and download formatted OpenAPI YAML or JSON specs.
- Correlated Threat Chains: Graph-based multi-signal engine that links related vulnerabilities into complete attack scenarios.
- Active OWASP Scanner: Runs 12+ client-side tests without sending telemetry or traffic to external cloud servers.
| Capability / Feature | MazAPI Platform (Ours) | APISec / BOLT | Akamai / Noname | Salt Security | Traceable AI | 42Crunch | StackHawk | OWASP ZAP | Nuclei | Schemathesis |
|---|---|---|---|---|---|---|---|---|---|---|
| PR-Time AST Route Discovery (7 Langs) | Yes (7 Langs) | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | |||
| Embedded C/C++ & IoT AST Parser | Yes (ESP/Arduino) | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ |
| Shadow API Git Base/Head PR Diff | Yes (Git diff) | ❌ | ❌ | ❌ | ❌ | ❌ | ||||
| AsyncAPI 3.0 & OpenAPI Auto-Synthesis | Yes (Both) | ❌ | ❌ | ❌ | ||||||
| IoT Protocols (MQTT / CoAP / OTA) | Yes | ❌ | ❌ | ❌ | ❌ | ❌ | ||||
| AI Agent Security Audit (11+ Fwks) | Yes (11+ Fwks) | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ||
| Cyber-Physical AI Actuation Guard | Yes | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ |
| CycloneDX 1.6 AI-BOM Generation | Yes | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ |
| MCP (Model Context Protocol) Audit | Yes (50+ Reg) | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | |
| Browser Side Panel Workbench | Yes (Side Panel) | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | |
| Active Zero-Egress OWASP & IoT DAST | Yes (100% Local) | ❌ | Yes (Cloud) | Yes (Local) | Yes (Local) | Yes (Local) | ||||
| ML Anomaly Detection Ensemble | Yes (99.73% RF) | Yes | Yes | Yes | ❌ | ❌ | ❌ | ❌ | ❌ | |
| Data Privacy / Zero-Egress Architecture | 100% Local | Cloud SaaS | Cloud / On-Prem | Cloud SaaS | Hybrid Cloud | Cloud / IDE | Cloud SaaS | 100% Local | 100% Local | 100% Local |
| Unified CLI & GitHub SARIF Export | Yes (cli.py) |
❌ | Yes | Yes | Yes | Yes |
Tip
Interactive Web Comparison Workbench: Launch the live interactive matrix web dashboard at http://localhost:9000/comparison or http://localhost:8000/comparison, or open comparison_workbench.html directly in your browser. Clicking on any feature row opens a deep-dive drawer analyzing technical capabilities, competitor gaps, security impact, and CLI/code snippets.
Run the complete multi-tier lab containing the vulnerable shop backend, mitigated target, and ML monitoring dashboard:
cd api-security-project
docker compose up -d --buildAccess the local services:
- Live Monitoring Dashboard:
http://localhost:9000/dashboard - Vulnerable Shop App (Port 8000):
http://localhost:8000/ui - Hardened API Target (Port 8001):
http://localhost:8001 - VulnBank Lab Target (Port 8002):
http://localhost:8002/lab/ui
The unified mazapi command-line tool provides a rich, colorized terminal interface for all security engines. Simply type mazapi or .\mazapi.bat in your terminal to see the interactive banner and command menu:
# Display rich interactive banner & command menu
mazapi
# 1. Scan Application Surface AST across multi-language source code
mazapi app-surface scan ./api-security-project/vulnerable-api --format table
# 2. Audit AI Agent workspace & export CycloneDX 1.6 AI-BOM
mazapi agent-audit scan ./api-security-project/agent_audit --governance --format ai-bom -o ./ai-bom.json
# 3. Audit Model Context Protocol (MCP) server registry & source code
mazapi mcp-audit registry
mazapi mcp-audit source-scan ./api-security-project/testing-engine
# 4. Audit IoT endpoints, MQTT brokers, CoAP, and OTA surfaces
mazapi iot-audit --target http://localhost:8000
# 5. Run active OWASP API Top 10 dynamic DAST scan & export SARIF
mazapi scan --target http://localhost:8000 --format sarif -o ./scan-results.sarif- Open your browser and navigate to
chrome://extensionsorbrave://extensions. - Enable Developer mode in the top-right corner.
- Click Load unpacked in the top-left corner.
- Select the directory:
./mazapi-extension - Click the extension icon in your browser toolbar to open the MazAPI BOLT Side Panel. Explore the built-in Guide tab for interactive walkthroughs.
- Open your VS Code or Antigravity IDE editor.
- Open the Command Palette (
Ctrl+Shift+PorCmd+Shift+P). - Type and select
Extensions: Install from VSIX.... - Choose the packaged extension package:
./mazapi-vscode/mazapi-scanner-1.0.3.vsix - Use the sidebar activity bar icon to configure target endpoints and trigger localized scans directly inside your editor.
MazAPI maps every finding to recognized security standards:
- OWASP API Security Top 10 (2023): API1 (BOLA), API2 (Broken Auth), API3 (BOPLA), API4 (Rate Limiting), API5 (BFLA), API7 (SSRF), API8 (Misconfig), API9 (Inventory/GraphQL).
- PCI-DSS v4.0: Requirements 6.2.4, 6.3.3, 8.2.1, 8.3.1.
- GDPR: Articles 5(1)(f), 25, 32 (Data protection and PII leakage prevention).
- ISO/IEC 27001: Annex A.9.4.1, A.14.2.5, A.18.1.4.
- CWE / CVE: CWE-22 (Path Traversal), CWE-601 (Open Redirect), CWE-312 (Cleartext Storage), CWE-650 (HTTP Verb Tampering), CVE-2015-9235 (JWT None Algorithm).
Run the full verification and unit test suite:
python run_all_tests.pyExpected output:
Ran 22 tests in 2.904s -> OK (100% Passed)
This project is licensed under the MIT License. Created for research and practical training in modern API, Agentic AI, and Cloud security architectures.