42Crunch for LLM agent tool exposure audit

What middleBrick covers

Black-box scanning with no agents or SDKs
Under-one-minute scan time
Read-only methods only
LLM/AI security adversarial probes
OpenAPI 3.x and Swagger 2.0 analysis
Authenticated scanning for Bearer, API key, Basic, Cookie

Scope and approach for LLM agent tool exposure

LLM agent tool exposure arises when agents invoke tools over HTTP, exposing endpoints that can be probed for information disclosure, authorization flaws, and unsafe consumption patterns. MiddleBrick is a black-box API security scanner designed for this surface: it submits a URL and returns a risk score with prioritized findings. The scanner operates without code access or SDKs, supports any language or framework, and completes in under a minute using read-only methods plus text-only POST for LLM probes.

It maps findings to OWASP API Top 10 (2023), covering common vectors relevant to agent tools such as unsafe webhook callbacks, excessive third-party URLs, and authorization leaks. Because the scan is read-only, destructive payloads are never sent, and private endpoints, localhost, and cloud metadata addresses are blocked at multiple layers.

Detection of LLM-related security categories

The scanner evaluates 12 categories aligned to OWASP API Top 10 (2023), including several that map directly to risks from LLM agent tool usage:

Authentication — multi-method bypass and JWT misconfigurations such as alg=none, HS256, expired claims, or sensitive data in claims.
SSRF — detection of URL-accepting parameters and body fields, internal IP patterns, and active IP-bypass probes.
Input Validation — CORS wildcard (with and without credentials), dangerous HTTP methods, and debug endpoints.
Data Exposure — PII patterns including email, Luhn-validated card numbers, context-aware SSN, and API key formats for AWS, Stripe, GitHub, and Slack.
Unsafe Consumption — excessive third-party URLs and webhook/callback surface.
LLM / AI Security — 18 adversarial probes across Quick, Standard, and Deep tiers, targeting system prompt extraction, instruction override, DAN and roleplay jailbreaks, data exfiltration, cost exploitation, encoding bypasses, translation-embedded injection, few-shot poisoning, markdown injection, multi-turn manipulation, indirect prompt injection, token smuggling, tool-abuse, nested instruction injection, PII extraction, and related techniques.

OpenAPI analysis and authenticated scanning

MiddleBrick parses OpenAPI 3.0, 3.1, and Swagger 2.0 with recursive $ref resolution, cross-referencing spec definitions against runtime behavior to surface undefined security schemes, sensitive fields, deprecated operations, and missing pagination. For authenticated scans at the Starter tier and above, support includes Bearer, API key, Basic auth, and Cookie, gated by a domain verification mechanism (DNS TXT record or HTTP well-known file) to ensure only the domain owner can scan with credentials. The scanner forwards a strict header allowlist limited to Authorization, X-API-Key, Cookie, and X-Custom-* headers.

Continuous monitoring and integration options

Pro tier adds scheduled rescans every 6 hours, daily, weekly, or monthly, with diff detection to highlight new findings, resolved findings, and score drift. Alerts are rate-limited to one per hour per API and delivered via email; HMAC-SHA256 signed webhooks are supported with auto-disable after 5 consecutive failures. Integration options include a web dashboard for trend tracking and branded compliance PDFs, a CLI via the middlebrick npm package with JSON or text output, a GitHub Action for CI/CD gating that fails builds below a score threshold, and an MCP Server for use with AI coding assistants.

What the scanner does not do and limitations

MiddleBrick does not fix, patch, block, or remediate; it detects and reports with remediation guidance. It does not perform active SQL injection or command injection, as those require intrusive payloads outside scope. The scanner does not detect business logic vulnerabilities, blind SSRF (out-of-band infrastructure is not in scope), or comprehensively replace a human pentester for high-stakes audits. Findings should be interpreted within the context of your architecture and threat model.

Compliance mapping and data handling

MiddleBrick maps findings to three frameworks: PCI-DSS 4.0, SOC 2 Type II, and OWASP API Top 10 (2023). For other regulations, the scanner helps you prepare for and aligns with security controls described in relevant standards, supporting audit evidence without asserting certification or compliance. Customer scan data is deletable on demand and purged within 30 days of cancellation; data is never sold and is not used for model training.

Frequently Asked Questions

Can MiddleBrick detect LLM-specific tool abuse such as prompt injection or tool misuse?

Yes. The LLM / AI Security category includes 18 adversarial probes across Quick, Standard, and Deep tiers that test for system prompt extraction, instruction override, jailbreaks, data exfiltration, cost exploitation, and tool-abuse patterns.

Does MiddleBrick support authenticated scans for APIs used by LLM agents?

Yes. Authenticated scans support Bearer, API key, Basic auth, and Cookie, with domain verification and a strict header allowlist to ensure only intended endpoints are tested.

How long does a scan take and what methods are used?

Scans complete in under a minute and use read-only methods (GET and HEAD) plus text-only POST for LLM probes. No destructive payloads are sent.

Can MiddleBrick integrate into CI/CD for LLM agent tool exposure checks?

Yes. The GitHub Action can gate CI/CD, failing the build when the score drops below a configured threshold, and the MCP Server allows scanning from AI coding assistants.

Is scan data retained or used for training models?

No. Customer scan data is deletable on demand, purged within 30 days of cancellation, never sold, and never used for model training.