Akto as a CLI API security scanner
What middleBrick covers
- Black-box API scanning with no agents or SDK dependencies
- Risk scoring with prioritized findings across 12 OWASP categories
- LLM adversarial probing across multiple scan depth tiers
- OpenAPI 3.x and Swagger 2.0 parsing with $ref resolution
- Authenticated scanning with strict header allowlisting
- Programmatic access via CLI, API client, and CI integrations
Akto as a CLI API security scanner
Akto is positioned as a command-line interface tool for API security scanning. It accepts a target URL and returns a structured risk assessment without requiring agents, SDKs, or code access. The design emphasizes broad compatibility, supporting any language, framework, or cloud environment through black-box interactions limited to read-only methods and text-only POST probes.
Detection coverage aligned to recognized standards
The scanner maps findings to OWASP API Top 10 (2023), covers requirements of PCI-DSS 4.0, and supports audit evidence for SOC 2 Type II. Detection spans 12 categories, including authentication bypass, broken object level authorization, excessive property exposure, input validation issues, rate limiting anomalies, data exposure patterns such as PII and API keys, and transport security misconfigurations.
For LLM-facing APIs, it runs 18 adversarial probes across Quick, Standard, and Deep scan tiers, targeting system prompt extraction, instruction override, jailbreak patterns, data exfiltration attempts, and token smuggling. OpenAPI 3.0, 3.1, and Swagger 2.0 specs are parsed with recursive $ref resolution, cross-referencing spec definitions against runtime behavior to identify undefined security schemes or deprecated operations.
Authenticated scanning and scope controls
Authenticated scanning is available from the Starter tier onward, supporting Bearer tokens, API keys, Basic authentication, and cookies. Domain verification is enforced through DNS TXT records or an HTTP well-known file, ensuring only the domain owner can submit credentials. Header forwarding is restricted to Authorization, X-API-Key, Cookie, and X-Custom-*, and safe methods such as GET and HEAD are used by default, with text-only POST allowed for LLM probes.
Product integrations and developer workflows
The CLI provides a direct entry point for engineers, invoked as middlebrick scan <url> with JSON or text output for scripting and automation. Scan results appear in a web dashboard with trend tracking and downloadable compliance reports. CI/CD integration is supported via a GitHub Action that can fail builds when scores drop below a defined threshold, and an MCP server enables scanning from AI coding assistants. Programmatic access through an API client allows custom integrations and scheduled workflows, while Pro tier adds continuous monitoring with diff detection and email alerts limited to one per hour per API.
Safety, limitations, and responsible disclosure guidance
The scanner operates read-only and never sends destructive payloads. Private IPs, localhost, and cloud metadata endpoints are blocked at multiple layers. Customer data can be deleted on demand and is purged within 30 days of cancellation, with no use for model training.
Limitations include no remediation, no active injection testing such as SQL or command injection, no detection of business logic flaws, no blind SSRF validation, and no replacement for human pentesters in high-stakes audits. The tool surfaces findings and remediation advice but does not fix, patch, block, or certify compliance with any regulatory framework.