01
API-focused security testing
Uses OpenAPI schemas to guide authorization checks and bounded fuzzing.
Lampart
What it does
Lampart reads your schema, attacks like someone who has it, and refuses to file a finding it cannot prove.
Authorization is checked on every declared route, fuzzing stays inside the bounds the schema allows, and each result is confirmed or dropped with explicit policies, positive controls, and replay. Race conditions run as concurrent requests with persisted-state assertions. The agent picks its own tools within scope, request, and token budgets, and everything runs from a CLI that saves evidence and writes JSON and Markdown reports, so a labeled regression suite fits straight into CI.
How it works
Lampart
Then it reports only what it proved.
0110
- Lampart reads the OpenAPI schema first.
- Lampart checks authorization on every route.
- Lampart fuzzes only inside declared bounds.
- Lampart confirms exposed data, not status codes.
- Lampart replays positive controls.
- Lampart races concurrent claims for lost updates.
- Lampart asserts persisted state after each race.
- Lampart keeps the agent inside its budgets.
- Lampart saves evidence and replayable cases.
- Lampart writes JSON and Markdown labeled for CI.
Capabilities
Five things it does that a status-code scanner does not.
02
Evidence-backed findings
Confirms protected-data exposure through explicit policies, positive controls, and replay rather than HTTP status alone.
03
Application race-condition checks
Tests lost updates and duplicate claims using concurrent requests and persisted-state assertions.
04
Controlled AI investigation
Go ADK lets the agent select testing tools and inspect source files within configured scope, request, and token budgets.
05
Reproducible, headless operation
A CLI with saved evidence, replayable read-only cases, JSON/Markdown reports, and a labeled regression suite makes it practical for CI.