OWASP · open source · MIT

API security testing that reads your code first.

OFFAT maps your API from source, follows every input across files on a code graph, runs its test plan with a Rust engine and triages the results with AI — or fully offline.

Get started How it works

$offat-platform run ./repo -o app.offat.json

pipeline app.offat.json

01Maproutes, params, specs
02Graphcalls · data flow · guards
03Planthreat model → test plan
04ExecuteRust · HTTP/2 · WS · gRPC
05TriageAI or offline heuristic
06ReportSARIF · HTML · compliance

91routes mapped in Juice Shop, 4,260 functions in 6.3 s

16/16planted flows found, zero safe twins flagged

4protocols in one engine: HTTP/1.1, HTTP/2, WebSocket, gRPC

0tokens required — every AI path has an offline fallback

What you get

One pipeline, one file, every stage inspectable.

Code graph, not grep

Interprocedural data flow for Python and JS/TS. Findings carry the hop-by-hop path and the route that reaches them.

The Bundle contract

Every stage reads and writes one versioned JSON document. Stop, inspect, edit and resume anywhere.

Identity-aware checks

Give it a few identities and it plans object- and function-level authorization checks with differential baselines.

AI where it pays off

Cached, batched and model-tiered triage that sees the proven path, plus an agent that reads the code around it.

A Rust engine

A single static binary for the network-heavy part: HTTP/1.1 and HTTP/2, WebSocket, gRPC, HTTP/3 opt-in.

CI-native output

SARIF with code flows for GitHub code scanning, JUnit, Markdown, HTML and a --fail-on gate.

Quick start#

git clone https://github.com/OWASP/OFFAT.git && cd OFFAT
pip install ./bundle ./triager './whitebox[graph]' ./graybox ./platform ./reporter

# source-only: maps, plans, triages and reports without sending traffic
offat-platform run /path/to/repo -o app.offat.json --report-dir reports

Building the Rust engine adds live execution against targets you are authorized to test.

Where to go next#

Installation - packages, engine, container, AI backends
Usage - the pipeline, stage by stage, identities and CI gates
How it works - the Bundle contract and the engine
Code graph - taint analysis and the AI built on it
GitHub Action - scan every push, publish to code scanning

Authorized use only. Live runs send real requests and require an explicit --yes. Only test systems and code you own or are authorized to assess.

Edit this page on GitHub