What problem does it solve? API endpoints that bind unexpected JSON fields to internal model properties can let attackers overwrite sensitive attributes, but confirming this safely requires strict authorization, controlled test objects, and authoritative server-side evidence rather than guesswork from HTTP responses. ## Core Features & Use Cases - Evidence-Gated Validation: Enforces a fixed baseline → single-field probe → post-baseline → authoritative state/audit → evidence workflow so findings rest on server-side proof, not response echoes or HTTP 200s. - Strict Safety Boundaries: Restricts testing to two self-owned identities, a rollback-capable test object, and harmless canary fields, explicitly forbidding role, owner, tenant, payment, email, MFA, or permission fields. - False-Positive Oracle & Routing: Defines what counts as valid proof versus inconclusive signals, and routes related findings to IDOR, HTTP parameter pollution, API misconfiguration, or business-logic workflows. - Use Case: Given an OpenAPI schema showing a PATCH profile endpoint, verify whether an undocumented canary field is persisted server-side for a low-privilege identity, confirmed via an independent authoritative read and then rolled back. ## Quick Start Ask the agent to plan an authorized, evidence-gated mass assignment validation against your own test API endpoint using a harmless canary field.
