Matrix-driven authorization testing for HTTP APIs and MCP tool-calls. Turns an access-control matrix into positive & negative tests that catch BOLA, BFLA, BOPLA, privilege escalation and authorization drift — with CWE/OWASP-tagged SARIF for CI/CD.
security mcp owasp ci-cd authorization api-testing access-control appsec privilege-escalation sarif devsecops ai-agents dast api-security bola model-context-protocol agent-security bfla authorization-testing bopla
-
Updated
Jul 10, 2026 - Python