25 Services from 47-85-47-24.sslip.io

Analyzes a Terraform plan for security risks, destructive changes, and policy violations, returning a risk score and BLOCK/WARN/PASS verdict

Statically analyzes a GitHub Actions workflow for security risks including privilege escalation, untrusted checkouts, and GITHUB_TOKEN misuse, returning a scored verdict (BLOCK/WARN/PASS).

Performs a multi-artifact static security analysis across Dockerfiles, Kubernetes manifests, GitHub Actions, Terraform, IAM policies, CloudFormation, and OpenAPI specs to produce a release gate verdict (PASS/WARN/BLOCK).

Audits a built-in risky Kubernetes deployment and ClusterRole against Pod Security Standards, RBAC least privilege, secret handling, image pinning, resource bounds, and network exposure — no live cluster required

Analyzes a built-in risky AWS IAM identity policy for administrator access, wildcard resources, PassRole, workload-creation escalation, secret access, and least-privilege violations without requiring live AWS account access

Audits a built-in vulnerable OpenAPI 3.1 contract against deterministic OWASP API Security Top 10 2023 checks and returns risk score, findings, and remediation plan without active scanning

Generates a built-in k6 smoke/load-test JavaScript script from an OpenAPI 3.x specification without executing the target API

Analyzes SQL CREATE TABLE schema changes for risk, blast radius, migration safety, and generates a safe patch and rollout plan

Generates a runnable TypeScript MCP stdio server from a built-in orders-API OpenAPI 3.x contract using the stable Model Context Protocol SDK v1

Generates a runnable pytest/httpx API test module from an OpenAPI 3.x contract using the built-in orders-api-tests scenario, without executing the target API

Statically analyzes a built-in risky Dockerfile for embedded secrets, mutable base images, unverified downloads, unsafe permissions, root runtime, and package-manager hygiene without building or pulling any image

Statically analyzes AWS CloudFormation templates for security risks, returning a structured verdict (BLOCK/WARN/PASS), risk score, and detailed findings by severity.

Reviews a built-in risky Docker Compose control-plane configuration for security vulnerabilities including privileged execution, host namespaces, broad capabilities, exposed Docker API ports, and mounted sockets without running containers

Converts a built-in OpenAPI 3.x specification into a Postman Collection 2.1 JSON file without executing the target API

Generates a TypeScript Fetch SDK from an OpenAPI spec using the built-in orders-api scenario, returning client source files, types, and operation wrappers.

Analyzes a built-in OpenAPI 3.x scenario (removed operation) for consumer-breaking changes, risk score, and versioned migration plan

Audits and validates an x402 payment challenge payload, scoring its risk, checking policy compliance, and returning a PASS/WARN/BLOCK verdict with detailed findings.

Generates Zod 4 TypeScript validator schemas from an OpenAPI spec using the built-in orders-api-zod-validators scenario

Performs a combined commercial production security gate review covering release security and x402 provider security, returning a structured verdict with risk score and component findings.

Generates WireMock stub mappings from an OpenAPI specification using the built-in orders-api-wiremock scenario

Generates Playwright API test code (api.spec.js) from an OpenAPI spec using the orders-api-playwright scenario

Generates a Pact contract file (v3 specification) from an OpenAPI spec using a built-in orders-api scenario

Performs an automated security review of x402 payment provider webhook/handler code, checking for HMAC integrity, SSRF risks, platform identity binding, and payment binding flaws.

Returns a downloadable ZIP archive containing the x402 provider production launch kit, including all files needed to deploy an x402-compatible paid API provider.

Returns a downloadable production launch kit ZIP archive for implementing x402 webhook security in API providers