middleBrick vs Apigee
What middleBrick covers
- Black-box scanning with no agents or code access
- 12 OWASP-aligned API security categories
- Under one-minute scan time
- External validation mapped to PCI-DSS 4.0 and SOC 2
- Multiple integration options including CLI and GitHub Action
- Continuous monitoring and diff detection in Pro tier
Scope and testing approach
middleBrick is a black-box API security scanner that submits requests to a reachable endpoint and analyzes responses. It does not require agents, SDKs, or access to source code and supports any language or framework. Scans complete in under a minute, using read-only methods plus text-only POST for LLM probes, and never send destructive payloads.
Apigee provides API management features such as developer portals, rate limiting, and analytics. Its security testing capabilities focus on policy enforcement, threat protection, and monitoring within the Apigee runtime. Public documentation does not describe a comparable out-of-band scanner that operates without runtime instrumentation.
Because middleBrick operates externally, it can validate observable security behavior without deploying code. Apigee’s strength lies in in-platform governance and traffic control, not in external black-box assessment.
Detection coverage and compliance mapping
middleBrick detects issues across 12 categories aligned to the OWASP API Top 10 (2023), including authentication bypass, JWT misconfigurations, BOLA, BFLA, over-exposed properties, input validation, rate limiting, data exposure, encryption issues, SSRF indicators, inventory risks, and LLM/AI security probes. It maps findings directly to PCI-DSS 4.0, SOC 2 Type II, and OWASP API Top 10 (2023).
Apigee supports security through policies for authentication, rate limiting, and threat detection. It can help you prepare for SOC 2 Type II and PCI-DSS 4.0 by enforcing controls at the gateway. Available documentation does not indicate coverage of the full OWASP API Top 10 as a testing framework.
middleBrick also surfaces findings relevant to audit evidence across these frameworks, though it does not certify compliance. It does not claim compatibility with HIPAA, GDPR, ISO 27001, NIST, CCPA, or other regulations.
Setup, access control, and integration footprint
middleBrick requires only a URL to start a scan. The domain owner must complete a verification gate, such as a DNS TXT record or an HTTP well-known file, to authorize authenticated scans. Supported authenticated methods include Bearer tokens, API keys, Basic auth, and cookies, with a strict allowlist of headers.
Apigee integration typically involves deploying gateways, syncing developer portals, and managing environments within its platform. Configuration is more infrastructure-heavy and tied to Apigee’s runtime model. Public documentation does not detail an equivalent out-of-box verification flow for external scanners.
middleBrick provides multiple integration options, including a web dashboard, CLI via an npm package, a GitHub Action for CI/CD gating, an MCP server for AI coding assistants, and a programmable API. Apigee’s integration options focus on its own ecosystem and proxy configurations.
Pricing model and operational impact
middleBrick offers a free tier with 3 scans per month and CLI access. The Starter plan costs 99 US dollars per month for 15 APIs, including monthly scans, dashboard, email alerts, and the MCP server. The Pro plan is 499 US dollars per month for 100 APIs, with continuous monitoring, GitHub Action gates, CI/CD integration, Slack or Teams alerts, compliance reports, and signed webhooks. Enterprise plans are priced at 2000 US dollars or more, with unlimited APIs and custom rules.
Apigee pricing is typically based on traffic volume, gateway operations, and feature tiers within its platform. Costs can scale with the number of developers, APIs, and runtime processing demands. Exact public pricing is not published and varies by contract.
middleBrick incurs no deployment overhead on your infrastructure and does not require pipeline changes beyond optional CI steps. Apigee introduces runtime dependencies and requires ongoing management of gateway policies and developer onboarding.
Limitations and responsible use
middleBrick does not fix, patch, block, or remediate issues; it detects and reports with remediation guidance. It does not perform active SQL injection or command injection testing, does not detect business logic vulnerabilities, and cannot perform blind SSRF testing that requires out-of-band infrastructure. It is not a replacement for a human pentester in high-stakes audits.
Apigee’s testing boundaries are generally limited to runtime policy enforcement and monitoring. It does not provide an external, low-overhead scanner focused on OWASP API Top 10 coverage and continuous monitoring.
middleBrick stores no customer data beyond scan histories that you control. Data is deletable on demand and purged within 30 days of cancellation. It is not used for model training.