Skip to content

APILeak v1.0.0

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 03 Nov 19:07
· 8 commits to main since this release
v1.0.0
2810f4f

APILeak v1.0.0 — MCP Server + AI Integration

This is the first production-stable release of APILeak, adding a full Model Context Protocol (MCP) server that exposes every scan capability as a tool invocable by AI agents (Claude Desktop, Kiro, custom LLM workflows).

What's New

MCP Server (apileaks mcp-server)

  • 16+ MCP tools — every CLI command exposed as a typed, schema-validated MCP tool
  • stdio transport — connect Claude Desktop, Kiro, or any MCP client with a single config line
  • HTTP/SSE transport — persistent server with Bearer token auth and optional TLS
  • Destructive Confirmation Gate — AI cannot execute destructive scans without a human ConfirmationToken
  • Append-only audit log — every tool invocation logged as JSON Lines (OWASP MCP08)
  • Rate limiting + timeouts — 60 req/min per client, 300s max per tool (OWASP MCP05)
  • Tool manifest hash — SHA-256 of registered tools logged at startup (OWASP MCP03)
  • All 10 OWASP MCP Top 10 controls implemented

AI Assistance (apileaks[ai])

  • --ai-triage — LLM-powered finding prioritisation (Anthropic / OpenAI / Amazon Bedrock)
  • --ai-dedup — semantic deduplication of overlapping module findings
  • Graceful degradation — AI errors never fail the scan

Offensive MCP Auditing (apileaks mcp-audit)

  • Tool poisoning detection (hidden prompt instructions in descriptions)
  • SSRF probing via URL-accepting tools
  • Missing confirmation gate check on destructive tools
  • Credential leak detection in tool responses

Docker

  • Dockerfile.mcp — dedicated MCP server image (Alpine, non-root, hash-verified deps)
  • docker compose --profile mcp up — one command to start the full stack
  • docker compose --profile mcp-audit up — security self-audit in Docker

Documentation & GitHub Pages

Installation

# MCP server only
pip install 'apileaks[mcp]'

# MCP + AI triage/dedup (Anthropic + OpenAI)
pip install 'apileaks[mcp,ai]'

# MCP + AI + Amazon Bedrock
pip install 'apileaks[mcp,ai,aws]'

Quick Start

# Connect to Claude Desktop or Kiro (stdio)
apileaks mcp-server --transport stdio

# HTTP server
export APILEAKS_MCP_AUTH_TOKEN=$(python -c "import secrets; print(secrets.token_urlsafe(32))")
apileaks mcp-server --transport http --port 8080

# Docker
APILEAKS_MCP_AUTH_TOKEN=secret docker compose --profile mcp up

Security Self-Audit

The MCP server passes its own apileaks mcp-audit security check on every release (dogfooding). Results are attached as a workflow artifact.

See the full MCP Security documentation for OWASP MCP Top 10 control details.

Full Changelog: v0.3.0...v1.0.0

Assets 2
Loading