Reads a local OpenAPI/Swagger file (JSON or YAML), auto-detects format, and selectively extracts routes and methods. Strips verbose descriptions to save up to 70% of LLM tokens.

Async resilient HTTP client with anti-blocking (WAF) protection and rate limiting. Supports multiple auth types: bearer, basic, api_key_header, api_key_query, cookie. When stealth mode is enabled, uses random delay between STEALTH_MIN and STEALTH_MAX to evade WAF detection patterns.

Executes the same HTTP request with two different tokens (privileged vs unprivileged) and compares responses to detect authorization failures (BOLA/IDOR). Automatically cleans volatile fields (timestamps, session_ids, etc.) and calculates structural similarity. Marks as 'is_suspicious_success' if both return 200 OK with >85% similarity. When stealth mode is enabled, uses random delay to evade WAF detection patterns. Supports multiple auth types: bearer, basic, api_key_header, api_key_query, cookie.

Stores a dynamic value in the session cache. Use after POST/PUT responses to save resource IDs for later use in DELETE/GET requests with a different auth token.

Retrieves a previously stored value from the session cache. Returns not_found if the key does not exist. Use to inject dynamic IDs into attack URLs.

Returns all key-value pairs stored in the session cache. Useful for the LLM to see what dynamic IDs are available for chained attack flows.

Clears all stored values from the session cache. Use at the start of a new audit cycle to avoid stale data contamination.

Extracts a specific value from a JSON response using dot-notation path. Essential for chained attacks where the LLM needs to grab a dynamically created resource ID from a POST response (e.g. 'data.id' → 42).