42Crunch for LLM cost runaway prevention

middleBrick focuses on API security characteristics relevant to LLM interactions, including prompt injection, jailbreak patterns, and token misuse. The scanner executes read-only methods (GET and HEAD) plus text-only POST for LLM probes, completing each scan in under a minute. This approach avoids intrusive payloads and does not perform active SQL injection or command injection testing.

The tool does not detect business logic vulnerabilities or blind SSRF, which require domain context and out-of-band infrastructure not in scope. It is not designed to fix, patch, block, or remediate issues, but to highlight risky patterns and provide guidance.

For LLM cost runaway prevention, middleBrick surfaces indicators such as exposed system prompts, instruction override attempts, and data exfiltration probes. It does not replace a human pentester for high-stakes audits or certify compliance with any regulatory framework.

The scanner evaluates 18 adversarial probes across three tiers (Quick, Standard, Deep). These probes target system prompt extraction, instruction override, DAN and roleplay jailbreaks, data exfiltration, cost exploitation, and encoding bypass techniques such as base64 and ROT13.

Detection coverage includes token smuggling, nested instruction injection, PII extraction, and indirect prompt injection. Findings are mapped to OWASP API Top 10 (2023), helping you prepare for security reviews where LLM interfaces are in scope.

Sensitive outputs such as error messages and stack traces are flagged, along with API key formats (AWS, Stripe, GitHub, Slack) that may appear in responses. This helps identify leakage paths that could be abused to increase operational costs or bypass guardrails.

middleBrick parses OpenAPI 3.0, 3.1, and Swagger 2.0 documents with recursive $ref resolution. It cross-references spec definitions against runtime findings, highlighting undefined security schemes, sensitive field exposure, deprecated operations, and missing pagination.

This analysis supports audit evidence for security reviews and surfaces findings relevant to controls around input validation and authorization. By comparing declared endpoints with observed behavior, the scanner identifies deviations that may indicate misconfigurations exploitable for cost abuse.

Authenticated scanning (Starter tier and above) supports Bearer, API key, Basic auth, and Cookie methods, with domain verification to ensure only the domain owner can scan with credentials. Header forwarding is limited to allowlisted authentication headers.

Pro tier provides scheduled rescans (6 hours, daily, weekly, monthly) and diff detection across scans to track new findings, resolved findings, and score drift. Email alerts are rate-limited to 1 per hour per API, and webhooks are HMAC-SHA256 signed, with auto-disable after 5 consecutive failures.

The platform integrates into existing workflows via a CLI (middlebrick scan <url>) with JSON or text output, a GitHub Action for CI/CD gating, and an MCP Server for use with AI coding assistants. The API client enables custom integrations for teams with specific monitoring requirements.

These capabilities help you prepare for consistent security validation without introducing heavy deployment friction. The scanner does not perform active exploitation, so it is complementary to, not a replacement for, deeper runtime monitoring or manual review.

middleBrick adopts a read-only safety posture, never sending destructive payloads. Private IPs, localhost, and cloud metadata endpoints are blocked at multiple layers to prevent accidental probing of internal infrastructure.

Customer scan data is deletable on demand and purged within 30 days of cancellation. Data is never sold and is not used for model training, aligning with privacy expectations for security tooling.

While the tool maps findings to PCI-DSS 4.0, SOC 2 Type II, and OWASP API Top 10 (2023), it does not certify compliance with HIPAA, GDPR, ISO 27001, NIST, CCPA, or other regulatory frameworks. Use it as a scanning component within a broader risk management process.