misconfigs Beta
Docs Pricing Sign in

API reference

Programmatic access to 5 subscanners (auto-detect within each domain), 27 specialized endpoints, and full stack. Upload a single config file or a .zip archive — nested paths inside the zip are scanned automatically. Get JSON findings (or add ?format=pdf for a report, ?format=sarif for GitHub/GitLab SAST). Every product scan includes intent_gaps where names or tags contradict settings. Use ?fail_on=critical,high to fail the request when findings exceed your severity threshold. Base path: /api/v1

GitHub Actions

Scan pull requests automatically

Add one GitHub Actions workflow file to your repo. On every pull request, GitHub runs it automatically — no server to host, no manual uploads.

1
GitHub triggers the workflow

When someone opens or updates a PR, Actions checks out the code.

2
Base and head are zipped

git archive builds a snapshot of the target branch and of the PR branch (whole repo tree, not a raw diff patch).

3
misconfigs compares attack paths

Starts an async scan job (async=1), polls until both zips are fully scanned (IaC, CI/CD, AI, network, identity), then surfaces new and fixed cross-domain kill chains. Expect ~10–12 minutes per run.

4
Comment + optional fail

Posts (or updates) a PR comment with the delta and minimum fix set. Use fail_on_new=critical,high to fail the check when the PR introduces new critical/high paths.

Copy workflow from Account

Subscanners auto-detect file types within a domain — same behavior as the upload forms on each scanner page. Use specialized endpoints when you want to target one engine.

Subscanners

subscanner POST /api/v1/ai

AI / MCP Scanner

Auto-detect MCP configs, agents, prompts, tool definitions, and RAG pipelines — same as the AI upload form.

View reference →
subscanner POST /api/v1/iac

IaC Scanner

Auto-detect Terraform, Kubernetes, Compose, CloudFormation, Helm, and Istio in an upload or zip.

View reference →
subscanner POST /api/v1/cicd

CI/CD Scanner

Auto-detect GitHub Actions, GitLab CI, Jenkins, Azure Pipelines, and CircleCI configs.

View reference →
subscanner POST /api/v1/network

Network Scanner

Auto-detect NGINX, Apache, HAProxy, Envoy, firewall rules, and load balancer configs.

View reference →
subscanner POST /api/v1/identity

Identity Scanner

Auto-detect IAM policies, AWS trust policies, Okta exports, and Azure Entra configs.

View reference →

Full stack

stack POST /api/v1/fullstack

Full Stack Scanner

Scan IaC, AI/MCP, CI/CD, network, and identity from one project .zip — includes cross-domain correlations and executive PDF

View reference →

Specialized scanners

Pin a specific engine when you already know the config type.

AI / MCP Scanner

ai POST /api/v1/ai/mcp

MCP Scanner

Dangerous tools, prompt leakage, permission escalation, tool chaining
ai POST /api/v1/ai/agent

Agent Config Scanner

Excessive permissions, unsafe tool access, autonomous execution
ai POST /api/v1/ai/prompt

Prompt Security Scanner

Hidden secrets, system prompt leakage, prompt injection
ai POST /api/v1/ai/tools

Tool Definition Scanner

Shell access, SSRF, file deletion, arbitrary code execution
ai POST /api/v1/ai/rag

RAG Security Scanner

Sensitive documents indexed, PII exposure, access control gaps

IaC Scanner

iac POST /api/v1/iac/terraform

Terraform Scanner

Trivy static analysis for Terraform/HCL
iac POST /api/v1/iac/kubernetes

Kubernetes Manifest Scanner

Privileged pods, HostPath, missing limits, root containers, cluster-admin
iac POST /api/v1/iac/docker_compose

Docker Compose Scanner

Host mounts, privileged mode, admin ports, hardcoded secrets
iac POST /api/v1/iac/cloudformation

CloudFormation Scanner

AWS misconfigurations in CFN templates
iac POST /api/v1/iac/helm

Helm Chart Scanner

Insecure defaults, privileged pods, secret exposure
iac POST /api/v1/iac/istio

Istio Scanner

mTLS mode, permissive authz, wildcard hosts, insecure gateways

CI/CD Scanner

cicd POST /api/v1/cicd/github_actions

GitHub Actions Scanner

Secrets, unpinned actions, dangerous triggers, privilege escalation
cicd POST /api/v1/cicd/gitlab_ci

GitLab CI Scanner

Runner abuse, secret leakage, privileged jobs
cicd POST /api/v1/cicd/jenkins

Jenkins Scanner

Anonymous access, script console, dangerous plugins
cicd POST /api/v1/cicd/azure_pipelines

Azure Pipelines Scanner

Container pinning, secret leakage, pipeline hygiene (Checkov + ci-doctor)
cicd POST /api/v1/cicd/circleci

CircleCI Scanner

Orb pinning, resource abuse, shell risks (Checkov + ci-doctor)

Network Scanner

network POST /api/v1/network/firewall

Firewall Rule Scanner

Any-any rules, exposed management ports, shadowed rules
network POST /api/v1/network/nginx

NGINX Scanner

Missing TLS, internal exposure, dangerous rewrites
network POST /api/v1/network/apache

Apache Scanner

Directory listing, weak TLS, missing security headers
network POST /api/v1/network/haproxy

HAProxy Scanner

Insecure frontends, exposed admin interfaces
network POST /api/v1/network/load_balancer

Load Balancer Scanner

Weak ciphers, open admin endpoints
network POST /api/v1/network/reverse_proxy

Reverse Proxy Scanner

Internal app exposure, TLS issues
network POST /api/v1/network/envoy

Envoy Scanner

Admin exposure, missing TLS, insecure CORS, XFF trust

Identity Scanner

identity POST /api/v1/identity/iam_policy

IAM Policy Scanner

Admin permissions, wildcards, privilege escalation
identity POST /api/v1/identity/aws_trust

AWS Trust Policy Scanner

Dangerous AssumeRole trust, cross-account risks
identity POST /api/v1/identity/okta

Okta Scanner

Weak MFA, excessive admin roles
identity POST /api/v1/identity/azure_entra

Azure Entra ID Scanner

Global admin sprawl, weak conditional access