open_endpoints
Read-onlyIdempotent
Identify publicly accessible Django REST Framework endpoints whose serializers expose sensitive fields, helping detect potential data leaks.
Instructions
Endpoints anyone can call, crossed with what their serializer exposes.
serializer_exposure knows CustomerExportSerializer leaks a password reset
token; a Semgrep rule knows a view has AllowAny. Each alone is a judgement
call - maybe the serializer only feeds an admin export, maybe the view
serves a catalogue. Together there is nothing left to judge, and neither
check can make the connection alone.
DRF's own default permission is AllowAny. A project that never configured
DEFAULT_PERMISSION_CLASSES has every view without explicit
permission_classes open, and none of them say so; that is volunteered
first. Views overriding get_permissions() are listed, not judged.
Args:
include_unbounded: also report open endpoints whose serializer uses
fields="__all__" or exclude, even with nothing sensitive on the
model today. The next migration decides what leaks.
Tool call template
This tool declares no required parameters. Add optional parameters from the input schema as needed.
{
"id": 1,
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"arguments": {},
"name": "open_endpoints"
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| include_unbounded | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||