"oracle" matching MCP servers:

Enables agents to rebuild a single-page app's full hidden API surface from stripped JavaScript bundles, diff it across attacker and victim identities to isolate role-gated routes, and then deterministically confirm cross-user access-control breaks (BOLA/IDOR) using the app's own sibling endpoints as the ownership oracle. Exposes six tools that return compact summaries plus artifact paths for fingerprinting, reconstruction, oracle discovery, diffing, proving, and reporting.