APIsec Bolt Browser Extension

Discover your full API attack surface directly from your browser: no proxies, agents, or setup required. As you interact with any web application, Bolt captures live API traffic, filters out noise, and builds a real-time inventory of endpoints and parameters. Export clean OpenAPI specs in one click and send APIs straight to APIsec.ai for automated security testing.

APIsec Bolt Code Discovery

Find every API endpoint hiding in your source code before it ships. This GitHub Action scans your repository at commit or on a schedule, automatically detects frameworks (Spring Boot, FastAPI, Flask, ASP.NET Core, and more), generates an OpenAPI 3.0 specification from your code, and raises a pull request with the results. Shift API discovery left and catch undocumented and shadow endpoints in the CI/CD pipeline, not in production.

MCP audit

See what your AI agents can actually access before attackers do. Scan Model Context Protocol configurations for exposed secrets, shadow APIs, and undeclared AI models, then generate AI-BOMs for compliance and governance. MCP Audit maps your agent trust boundaries so you can identify misconfigurations and over-permissioned connections across your AI infrastructure.

AI Surface

Find and govern the AI surfaces in your application code at PR time. AI Surface is a static source-code analyzer that detects LLM SDK call sites across 12 providers, agent frameworks like LangChain, LangGraph, and CrewAI, MCP servers, model gateways, and AI infrastructure — flagging 13 risk indicators including financial actions, destructive operations, broad permissions, and exposed provider API keys. Runs 100% locally with no network calls or telemetry, ships as a GitHub Action with sticky PR diff comments, and supports baseline mode to track only newly introduced AI surfaces. Make your AI attack surface visible to the security team before attackers find it.

APIsec Skills

Make your AI coding assistant write secure APIs by default. Five always-on rules and six on-demand skills put the OWASP API Security Top 10 inside Claude Code, Cursor, GitHub Copilot, OpenAI Codex, Gemini CLI and Windsurf. There is nothing to configure, and nothing leaves your machine.