Your APIs have a risk score.
Scan any API for OWASP, LLM prompt injection, and Web3 exposure — a quantified security score in minutes. Point at a URL, or run the agent inside your network so nothing leaves it.
THE PROBLEM
The clock is already running.
212 days is the average time to detect an API breach. Most APIs are never scanned until it's already too late. — Ponemon / IBM, 2024
THE MANIFESTO
The attacker's view of your API.
For every team.
For years, seeing your own API the way an attacker does was a luxury. Tens of thousands of dollars. Months of waiting. So most APIs never got looked at.
We think that's backwards.
Every team that ships an API deserves the attacker's view of it — not a six-figure engagement, but a command you can run today.
And it runs inside your own network. Blackglass holds the attacker's mirror up to your surface and scores it — while not a single raw byte leaves your perimeter. Only a signed, abstract signature does.
HOW IT WORKS
Connect. Scan. Score.
Connect
Point middleBrick at your endpoints — REST, GraphQL, AI/LLM, or Web3 JSON-RPC. Or run the agent inside your network.
Scan
It analyzes authentication, input validation, and data exposure — read-only and non-destructive. Nothing is written, nothing is blocked.
Score
You get a quantified risk score (A–F) with prioritized, actionable remediation — and a report your team can replay.
PRICING
Priced like software.
Worth a pentest.
A one-off manual pentest runs $15k–$30k. This runs continuously, for a fraction — and the data never leaves your network.
Free
Secure your first APIs
- 10 endpoints monitored
- 20 scans per month
- Risk score (A–F) + findings
- Monthly automated scans
- CLI · GitHub Action · MCP
- CI/CD pass/fail gate
Pro
For teams shipping APIs
- 50 endpoints monitored
- Unlimited scans
- Authenticated scanning
- Weekly automated scans
- Compliance reports (PDF)
- Email alerts · 90-day audit log
Startup
Complete security at scale
- 250 endpoints (+$7 each)
- Continuous monitoring
- Webhooks · Slack / Teams
- CI/CD threshold gates
- Up to 10 team members
- All compliance frameworks
Enterprise
Nothing leaves your perimeter
- Unlimited endpoints
- SSO / SAML · MFA
- Custom roles (RBAC)
- 365-day audit log
- 99.95% SLA
- Data export + erasure
ONE QUESTION
What's your API risk score?
You're either scanning or guessing.
The scan is free. The agent runs in your network — nothing leaves it.