Deterministic interface specification audit for broken object authorization, mass assignment, and server-side request forgery
Backend authorization flaws originate in route and schema contracts long before application code reaches staging. Load an OpenAPI 3.x or Swagger 2.0 document below to uncover unauthenticated state mutations, exposed object identifiers, writable privilege properties, and outbound webhook sinks, then export a route-level filter policy.
.json or .yaml contract.Inspect Raw JSON API Response & Ledger Entry
{}1. Schema graph traversal and gateway rule synthesis
Recursive resolution of internal $ref pointers across paths, security schemes, and request bodies, compiling route-level invariants for mcp-sentinel 1.1.2.
2. Eight structural API vulnerabilities caught directly from the specification
Signature firewalls inspect query strings for syntax anomalies yet remain blind when an authenticated caller substitutes another customer's order number in /orders/{order_id} or submits is_admin: true inside a profile update payload. Those defects correspond to OWASP API1:2023 Broken Object Level Authorization and API3:2023 Broken Object Property Level Authorization.
The specification auditor resolves internal schema references and checks every HTTP operation for cleartext server URL entries, API keys leaked in query strings, state-changing methods lacking security requirements, object-identifier routes requiring subject-ownership predicates, writable privilege fields, user-controlled callback endpoints susceptible to SSRF, unbounded array inputs, and embedded sample credentials.
Instead of stopping at a static warning list, the compiler translates each risky route into an explicit enforcement entry specifying mandatory bearer authentication, principal-to-resource binding, forbidden request fields, private-subnet egress blocking, and payload byte ceilings.
3. Enforcing compiled API contracts inline and testing live endpoints safely
Teams protecting production microservices load the compiled JSON policy into the open mcp-sentinel 1.1.2 middleware or enforce formal invariants at sub-ten-millisecond speed with the MITR Z3 gateway (asi5.ru), while differential live verification against paired decoys is available through isslab.ru.
4. Engineering reference notes for verifier TOOL-API-04
Support for both YAML and JSON specifications with nested references
The parser accepts both JSON and YAML OpenAPI 3.x and Swagger 2.0 specifications up to 256 kilobytes and resolves local component references automatically.
Blocking BOLA and mass assignment at runtime with the compiled contract
The generated route policy strips undeclared privilege fields such as role or balance before handler execution and requires explicit session-owner verification on parameterized object paths.
Enterprise pilot packages and air-gapped delivery
Perimeter posture, transport security & localization
Streebog-256 verification passport.Air-gapped interface verification (indra-core)
OpenAPI schemas and an isolated staging container as input, delivering a thirty-class paired decoy assessment with zero false positives, compiled mcp-sentinel contracts, and a full ledger passport.Autonomous agent runtime gate (MITR)
mcp.json manifests and tool schemas as input, delivering compiled satisfiability policies and pre-socket parameter enforcement.Request the offline kit or schedule a pilot
--no-index --find-links) and standalone verifier scripts are provided for isolated laboratory testing and enterprise pilot evaluations. Submit a work email below without page reload or write directly to af@isslab.ai.
Institutional developer and platform operator
OGRN 1267700083617, INN 9731161602, KPP 773101001, 18 Davydkovskaya Street, Suite VIII, Moscow, 121352). Under the Security 3.0 research and engineering program, the institute develops and operates the MITR runtime action gateway and the INDRA verification stand, publishes the monograph Proven Action, and maintains open Apache-2.0 software packages with zero outside subcontractors.