Four deterministic checks
- KEY-EXP-01 query-parameter keys or tokens
- HTTP-001 insecure server URLs
- AUTH-001 missing documented authentication
- KEY-EXP-02 undocumented static-key lifetime or rotation
OpenAPI Security
Catch contract-level security gaps before runtime.
Speculynx scans OpenAPI 3.0 and 3.1 files locally, returns deterministic findings and explicit coverage, and keeps every conclusion scoped to the declared contract.
Free → Pro
Start with four local controls. Expand with ten Pro heuristics.
Free works without a license or backend connection. Pro adds heuristic coverage, PDF export, and bounded live checks.
Ten additional heuristics
Review authorization, object access, rate limiting, data exposure, and other contract signals with explicit rule execution and coverage metadata.
Pro also adds PDF output and a bounded scan-live mode. It remains separate from Agent Security.
Output contract
A finding is a signal to verify.
JSON schema 1.0 reports executed, skipped, and non-evaluated rules; per-control status; findings; coverage; and verdict.
$ speculynx scan --file openapi.yaml --json
schema_version 1.0
coverage.status partial
finding AUTH-001
verdict indeterminate
What static analysis does not prove: absence of vulnerabilities, live reachability, runtime authorization enforcement, exploitability, or production safety. A no-finding Free result is indeterminate, not “secure.”
Run your first contract review locally.
Install from PyPI and scan an OpenAPI 3.0 or 3.1 file without uploading it.
Free $0 · Pro $19.99/mo Pro is a monthly subscription and remains separate from all Agent Security purchases.