Is Kong worth it?

This tool is a black-box API security scanner. You submit an endpoint, receive a risk score from A to F, and get prioritized findings. It performs read-only testing with GET and HEAD methods, and text-only POST for LLM probes. Scan duration is under one minute. The scope covers the OWASP API Top 10 (2023), with additional coverage for LLM-specific adversarial testing and OpenAPI specification analysis.

The scanner covers 12 security categories and maps findings to three frameworks: PCI-DSS 4.0, SOC 2 Type II, and OWASP API Top 10 (2023). Detection includes authentication bypass and JWT misconfigurations, broken object level authorization, function level authorization abuse, property level authorization issues, input validation problems such as CORS misconfigurations and dangerous methods, rate limiting and resource consumption issues, data exposure including PII and API key leakage, encryption and transport security, SSRF indicators, inventory management gaps, unsafe consumption surfaces, and LLM/AI security probes across tiered scan depths.

OpenAPI analysis supports versions 3.0, 3.1, and Swagger 2.0 with recursive $ref resolution, comparing spec definitions against runtime behavior to identify undefined security schemes, deprecated operations, and missing pagination. For other regulations, the tool aligns with described security controls and supports audit evidence collection, but does not certify compliance.

Authenticated scanning is available in paid tiers and supports Bearer tokens, API keys, Basic auth, and cookies. Domain verification is required, allowing only the domain owner to run credentialed scans. The scanner forwards a restricted header set: Authorization, X-API-Key, Cookie, and X-Custom-*. Read-only methods are enforced; no destructive payloads are sent. Private IPs, localhost, and cloud metadata endpoints are blocked at multiple layers. Customer data can be deleted on demand and is purged within 30 days of cancellation.

The tool does not fix, patch, or block issues; it reports findings with remediation guidance. It does not perform active SQL injection or command injection testing, as those fall outside the read-only scope. Business logic vulnerabilities require domain expertise and are not detectable automatically. Blind SSRF and certain infrastructure-level issues are out of scope. The scanner does not replace a human pentester for high-stakes audits. Results should be interpreted as part of a broader security program, not a standalone compliance guarantee.

The Web Dashboard provides scan management, score trends, and downloadable compliance PDFs. The CLI, distributed as an npm package, supports commands such as middlebrick scan <url> with JSON or text output. A GitHub Action can gate CI/CD, failing builds when scores drop below a set threshold. An MCP server enables scanning from AI coding assistants. Programmatic access is available via an API client for custom integrations. Pro tier adds scheduled rescans, diff detection, email alerts, and webhook delivery with HMAC-SHA256 signing.