Self-hosted alternatives to api-security-testing

A

api-security-testing

Security-test a REST, GraphQL, or gRPC API with Strix

api-security-testing is a skill from the Strix project for security-testing a REST, GraphQL or gRPC API with autonomous agents. It explains why APIs need a different approach from web interfaces: there is no rendered surface to crawl, the most serious bugs are about authorization rather than injection, and the same endpoint can behave differently for each token. The workflow starts by gathering what the agents need. A schema, such as an OpenAPI or Swagger file, a Postman collection, a GraphQL endpoint or a gRPC proto file, lets the agents enumerate endpoints instead of guessing, and an OpenAPI or Postman file can be passed directly, while a proto file is passed as a workspace file. Two sets of credentials, ideally in different tenants, are needed to prove broken object-level authorization, and a low-privilege and a high-privilege token help prove function-level authorization problems. The skill also asks for example object IDs, out-of-scope routes, and any rate limits or web application firewall in front of the API. It uses the OWASP API Security Top 10 from 2023 as its coverage checklist. Only test APIs you own or are authorized to test, and prefer a staging environment, since the agents send real exploit payloads. It passes Gen Agent Trust Hub and Snyk on skills.sh, and Socket shows a warning. It has about 10,200 installs. Install it with npx skills add https://github.com/usestrix/strix --skill api-security-testing.