Bola Python Packages

websec-validator

Local-first security recon for AI coding agents: map attack surfaces, stage tailored probes, and produce a fact-grounded brief. Part of the Guard family with DocGuard and TestGuard.

granttrace

Evidence-driven API authorization security auditing tool for BOLA, IDOR and Mass Assignment testing.

vamp-graphql-audit

GraphQL DAST auditor — introspection, BOLA/IDOR, alias rate-limit bypass, deep nesting DoS, injection (SQLi/SSTI/XSS), subscription security

overstep

Authorization regression testing for REST APIs and MCP servers in CI/CD. Define access policies as a matrix, generate positive and negative tests, and detect BOLA, BFLA, BOPLA and privilege escalation — with drift baselines, confidence grading and CWE/OWASP-tagged SARIF reports.

sechelix

Most AI security tools try to find more. SecHelix tries to prove itself wrong: every candidate finding goes to an independent verifier whose only job is to disprove it. Open-source AppSec agent for Claude Code, Codex and Copilot.

mcp-api-pentest

MCP server for autonomous API logic penetration testing. AI-driven detection of OWASP API Top 10 vulnerabilities (BOLA/IDOR) via multi-session authorization comparison. Supports Bearer, Basic, API Key, Cookie auth. Generates Markdown security audit reports with evidence.

authztrace

Authorization contract testing for IDOR/BOLA in CI

heretic-agent

Autonomous AI agent that finds business-logic vulnerabilities (BOLA/IDOR, data exposure, price/workflow). Oracle-verified, ~0 false positives. Validated live on crAPI, Juice Shop, VAmPI.