Api Security Python Packages

sqlmap

Automatic SQL injection and database takeover tool

fastapi-payloadshield

Pluggable FastAPI decorators for encrypting/decrypting request and response payloads

guard-core-mcp

MCP server for the Guard ecosystem — config validation, docs search and live threat detection for fastapi-guard, guard-core and guard-agent. Answers from the versions installed in your project, not from a model's memory.

deluluscan

AI-augmented, evidence-first security auditor for authorized testing — web, API, LLM/AI, container, cloud & source code. Pluggable AI (Claude/OpenAI/DeepSeek/Ollama), agentic exploitation, deep verification, multi-format reports. AGPL-3.0.

granttrace

Evidence-driven API authorization security auditing tool for BOLA, IDOR and Mass Assignment testing.

permitprobe

Defensive security CLI for testing API authorization, response-data boundaries, and AI handoff exposure.

offat

The OWASP OFFAT tool autonomously assesses your API for prevalent vulnerabilities, though full compatibility with OAS v3 is pending. The project remains a work in progress, continuously evolving towards completion.

vamp-graphql-audit

GraphQL DAST auditor — introspection, BOLA/IDOR, alias rate-limit bypass, deep nesting DoS, injection (SQLi/SSTI/XSS), subscription security

vamp-oauth-audit

OAuth 2.0 and OIDC security flow auditor — PKCE, state, implicit flow, open redirect, token analysis.

overstep

Authorization regression testing for REST APIs and MCP servers in CI/CD. Define access policies as a matrix, generate positive and negative tests, and detect BOLA, BFLA, BOPLA and privilege escalation — with drift baselines, confidence grading and CWE/OWASP-tagged SARIF reports.

burp2model

Turn a Burp Suite history into an evidence-backed model of a web app's attack surface. Query it with no AI; every claim cites a request.

oidc-jwt-verifier

Framework-agnostic JWT verifier for OIDC issuers with JWKS caching, strict claim validation, and scope/permission checks.

yubel

Cloud-native, multi-target DAST orchestrator — one config runs ZAP, Nuclei, Nikto, testssl.sh, dalfox, schemathesis, kube-hunter and more against web, APIs, cloud, containers and Kubernetes. Cross-engine correlation, attack-chain synthesis, deterministic evidence trail and air-gapped mode.

fencer

Automated API security testing

metlo

Metlo is an open-source API security platform.

opensecstack-sdk

Open-source cybersecurity ecosystem for Europe and beyond — 11 integrated security platforms (API security, NIS2 compliance, incident response, threat intel, DDoS mitigation, AI-attack defence, and more) plus a shared identity layer and CITADEL governance/audit engine.

django-payloadshield

Pluggable Django decorators for encrypting/decrypting request and response payloads

mcp-api-pentest

MCP server for autonomous API logic penetration testing. AI-driven detection of OWASP API Top 10 vulnerabilities (BOLA/IDOR) via multi-session authorization comparison. Supports Bearer, Basic, API Key, Cookie auth. Generates Markdown security audit reports with evidence.

fastapi-safeguard

Startup-time security checks for FastAPI - missing auth, exposed fields, CORS misconfigs. Baseline lock file makes security posture reviewable in PRs.

authztrace

Authorization contract testing for IDOR/BOLA in CI

keyreach

Paste a leaked API key and get a full capability map, computed severity, and a disclosure-ready security report — deterministic, read-only, zero AI/LLM.

presidio-hardened-angellist

Presidio security-hardened deal-flow triage & due-diligence toolkit for early-stage (pre-seed / seed) startups sourced via AngelList syndicates.

aun-detection

At the edge of code and consciousness, Aun ∿ applies nondual collapse logic to expose imitation in digital trust.

sentinel-rate-limiter

Application-aware, tenant-aware, distributed rate limiting library