Differential Route Inventory Verification and Positive OpenAPI Contract Enforcement
A company secures its current /api/v3/ endpoints with strict authentication, but an old /api/v1-beta/ route remains running on the same server without those protections. The verifier diffs live routing tables against the signed OpenAPI specification and compiles a positive route-allowlist rule for border enforcement.
Improper inventory management leaves organizations exposed through two classes of unmonitored endpoints: zombie interfaces, which are deprecated legacy versions (/api/v1/, /beta/) that remain reachable without modern authentication middleware, and shadow interfaces, which are internal diagnostic or partner routes deployed without registration in the security gateway catalog.
Security Officer (Plain Meaning): Halts "Invoke undocumented administrative delete route or exfiltrate bulk records via legacy v1 endpoint" before socket (0 live DB damage, signed GOST receipt)
IT Auditor & SecOps (Evidence): Scope OWASP API9:2023 (Improper Inventory Management) | Wire Rule SEC-ZD-V2-12 | Formal Witness 29c6f183e5047b19
Technocrat, CTO & VC (Moat): Z3 Invariant (assert (=> (not (member (tuple (http_method call) (canoni... | FP = 0.0% | Contract IMMUNE-SHD-29C6F183 (mcp-sentinel 1.1.2)1. In-Path Interception and Contract Synthesis Schematic for API-SHD-12
Deterministic verification flow for API-SHD-12 (OWASP API9:2023 (Improper Inventory Management), WSTG-CONFIG-05 / CWE-1059): wire filter SEC-ZD-V2-12 intercepts destructive mutations prior to socket delivery, formal witness 29c6f183e5047b19 proves the flaw, and compiler emits gateway rule IMMUNE-SHD-29C6F183 for mcp-sentinel.
2. Zero-Damage Wire Filtering and Formal Solver Invariant for API-SHD-12
Under rule SEC-ZD-V2-12, the software wire filter restricts inventory discovery to non-mutating HEAD, OPTIONS, and safe schema-diff probes. Destructive verbs (DELETE, PUT, PATCH) against undocumented routes are blocked before reaching the socket.
On the benchmark stand, the verifier compares the live router tree against the signed OpenAPI contract and hardened gateway decoys. Detecting an active route absent from the specification records formal witness 29c6f183e5047b19 with zero false positives.
Class Identifier: API-SHD-12 (shadow_zombie_api_discovery)
Taxonomy Concordance: OWASP API9:2023 (Improper Inventory Management) | WSTG-CONFIG-05 / CWE-1059
Execution Mode: Active Safe Probing (AUTO_SCAN)
Candidate Probe: GET /api/v1-beta/internal/users/export (Unlisted in OpenAPI v3 spec; missing rate-limit & MFA middleware)
Blocked Mutation: Invoke undocumented administrative delete route or exfiltrate bulk records via legacy v1 endpoint
Z3 Solver Invariant: (assert (=> (not (member (tuple (http_method call) (canonical_route call)) signed_openapi_contract)) (= (gateway_allow call) false)))
Wire Sandbox Rule: SEC-ZD-V2-12
Formal Witness Hash: 29c6f183e5047b19
Compiled Sentinel Rule: IMMUNE-SHD-29C6F183 (mcp-sentinel 1.1.2)3. Autonomous Synthesis of Gateway Contract IMMUNE-SHD-29C6F183 and Streebog-256 Receipt
From witness 29c6f183e5047b19, the compiler generates rule IMMUNE-SHD-29C6F183 for border enforcement. The contract enforces a positive-security allowlist inside mcp-sentinel, rejecting any request whose method and normalized path are not explicitly signed in the active specification.
4. Engineering Reference Notes for API-SHD-12
Finding shadow and legacy API routes without noisy dictionary brute-forcing
The verifier combines static framework router inspection, client bundle route extraction, and safe version-prefix differential checks, pinpointing undocumented routes with surgical precision.
Blocking calls to deprecated API versions in production
Because mcp-sentinel enforces a positive allowlist compiled directly from the signed OpenAPI manifest, any zombie or shadow route omitted from the current contract is rejected at the edge before reaching the router.