"oracle" matching MCP servers:

Enables agents to rebuild a single-page app's full hidden API surface from stripped JavaScript bundles, diff it across attacker and victim identities to isolate role-gated routes, and then deterministically confirm cross-user access-control breaks (BOLA/IDOR) using the app's own sibling endpoints as the ownership oracle. Exposes six tools that return compact summaries plus artifact paths for fingerprinting, reconstruction, oracle discovery, diffing, proving, and reporting.

Exposes selected Swagger Petstore GET operations as callable tools for querying pets by status, tags, or ID. Supports deployment with OCI Generative AI and live testing through the Responses API.