LLM agent tool endpoints security

Run the LLM agent tool endpoints security check

What middleBrick covers

  • Black-box API scanning without agents or SDK integration
  • Under one-minute scan time with prioritized findings
  • Detection of authentication, IDOR, and privilege escalation risks
  • LLM adversarial probe coverage across multiple scan tiers
  • OpenAPI spec parsing with cross-reference validation
  • Continuous monitoring and diff detection for score trends

Threat model for LLM agent tool endpoints

LLM agent tool endpoints expose structured interfaces that an autonomous model can invoke programmatically. The primary risk is that an LLM, through prompt or tool manipulation, triggers actions, reads sensitive data, or escalates privileges on behalf of the caller. Black-box scanning can surface indicators of insecure endpoint design, such as missing input validation, weak authorization, and verbose error paths that reveal internal behavior. Because the scanner does not execute business logic, it identifies surface-level signals and deviations from secure patterns rather than deep logical flaws that require domain knowledge.

What the scanner checks for LLM tool interfaces

The scanner treats LLM tool endpoints as standard API operations and evaluates them against the OWASP API Top 10 (2023). It looks for injection-related input validation gaps, including CORS wildcard usage and dangerous HTTP methods that broaden exposure. Sensitive data exposure checks include API key formats such as AWS, GitHub, and Stripe patterns, as well as PII like email addresses and context-aware SSNs. The scan also examines authentication schemes, security headers, and whether error responses leak stack traces or internal details that could aid an adversary in crafting adversarial prompts.

  • Authentication issues, including malformed or missing security headers and WWW-Authenticate compliance.
  • Input validation problems, such as CORS wildcards with credentials and unrestricted methods.
  • Data exposure through leaked keys, tokens, and personally identifiable information patterns.
  • SSRF indicators when endpoints accept URLs or host parameters without strict allowlists.
  • Rate limiting signals, including missing rate-limit headers and oversized responses.

Authenticated scanning of protected tool endpoints

For endpoints that require authentication, the Starter tier and above support Bearer tokens, API keys, Basic auth, and cookies. Access requires domain verification via DNS TXT record or an HTTP well-known file, ensuring that only the domain owner can submit credentials. The scanner forwards a restricted set of headers, including Authorization, X-API-Key, Cookie, and X-Custom-*, to reduce the risk of credential leakage. This approach allows controlled assessment of authenticated tool paths while preserving read-only safety, with destructive methods explicitly excluded.

curl -H "Authorization: Bearer YOUR_TOKEN" https://api.example.com/v1/agent/tools

LLM-specific adversarial probes during Deep scans

In Deep scan mode, the scanner runs an expanded set of LLM-focused probes to evaluate how endpoints respond to manipulation attempts. These include system prompt extraction attempts, instruction override tries, DAN and roleplay jailbreaks, data exfiltration probes, cost exploitation checks, and encoding bypass techniques such as base64 and ROT13. The scanner also tests for few-shot poisoning, markdown injection, multi-turn manipulation, indirect prompt injection, token smuggling, tool-abuse patterns, nested instruction injection, and PII extraction attempts. Each probe is designed to surface behavioral inconsistencies without executing destructive actions.

OpenAPI 3.0, 3.1, and Swagger 2.0 specifications are parsed with recursive $ref resolution, and findings are cross-referenced against the spec to detect undefined security schemes, sensitive fields, deprecated operations, and missing pagination that could amplify risk when interacting with agent tools.

Reporting, compliance mapping, and limitations

Scans produce a risk score from A to F and a prioritized list of findings with remediation guidance. Results can be reviewed in the web dashboard, tracked over time, and exported as branded compliance PDFs. The scanner maps findings to PCI-DSS 4.0, SOC 2 Type II, and OWASP API Top 10 (2023), and it helps you prepare for audits by surfacing findings relevant to those frameworks. It does not fix, patch, block, or remediate issues, nor does it perform intrusive exploit testing such as active SQL or command injection. Business logic vulnerabilities and blind SSRF remain out of scope, and the tool does not replace a human pentester for high-stakes assessments.

Run this check on your API See all use cases

Frequently Asked Questions

Can the scanner test endpoints that require authentication?
Yes, Starter tier and above support Bearer, API key, Basic auth, and cookie authentication with domain verification to ensure only the domain owner can scan protected endpoints.
Does the scanner perform active injection tests like SQL or command injection?
No. The scanner focuses on input validation and exposure indicators and does not send destructive or intrusive payloads.
What LLM-specific checks are included in a Deep scan?
Deep scans include adversarial probes for prompt extraction, instruction override, jailbreaks, data exfiltration, cost exploitation, encoding bypasses, and token smuggling, among others.
How are findings mapped to compliance frameworks?
Findings map directly to PCI-DSS 4.0, SOC 2 Type II, and OWASP API Top 10 (2023). For other frameworks, the scanner supports audit evidence collection and aligns with described security controls.