Receives tools
An agent is connected to operations defined by an API surface.
AI agent API security
Know what your AI agents can access before they act.
Map exposed API capabilities. Find agent-readiness gaps. Gate risky capability changes—from the OpenAPI contract, before integration.
Local-first static analysisOpenAPI 3.0 / 3.1No source spec upload
$ speculynx agent capabilities --file openapi.yaml
17documented capabilities
3sensitive operations
$ speculynx agent readiness --file openapi.yaml
verdictREVIEW_REQUIRED
blockers2
$ speculynx agent gate --baseline main.yaml --candidate pr.yaml
verdictFAIL
new sensitive capabilityPOST /refunds
Illustrative output — not customer data
01Product proof
OpenAPI in. Capability decisions out.
Speculynx turns the API contract into structured evidence for agent builders, security teams, and CI. The facts come from deterministic analysis; your team makes the final decision.
INPUTopenapi.yaml
Declared operations and security metadata
ANALYSISMAP → REVIEW → GATE
Static, deterministic, local-first
OUTPUTREVIEW
Structured terminal and JSON evidence
02The problem
An agent doesn’t need a software vulnerability to become dangerous.
It may simply inherit an API operation with more capability than the team intended. The declared contract can expose that blast radius before the integration is wired.
Declares actions
GET /customers · POST /refunds · DELETE /users
Inherits capability
Write, financial, privileged, destructive, or sensitive-data access.
Requires review
Speculynx makes the documented surface visible before integration.
03Agent Security workflow
One workflow. Three distinct decisions.
Map what the API exposes, review whether the documented surface is appropriate for agent access, and gate security-relevant changes before they ship.
01 / MAPMAP
Capability Mapper
What could an AI agent do through this API?
02 / REVIEWREVIEW
Agent API Readiness
What needs review before agent integration?
03 / GATEGATE
Integration Gate
Did this change introduce dangerous capability?
SUITE
Need all three decision layers? Agent Security Suite grants exactly Capability Mapper, Agent API Readiness, and Integration Gate.
Explore Agent Security Suite →04OpenAPI Security
Start with contract-level security signals.
The OpenAPI Security scanner is the lower-friction entry point: four Free controls, ten additional Pro heuristics, deterministic output, and explicit coverage.
FREE
Run locally without an account.
Review four high-signal controls. A no-finding Free result remains indeterminate because Pro rules were not executed.
Explore OpenAPI Security →PRO
Expand the static review.
Add ten heuristics, PDF output, and bounded live checks. Pro does not grant Agent Security products.
Compare product families →05Built for technical teams
Concrete evidence for the people shipping agents.
Each team sees the same deterministic contract facts through the decision it owns.
AI ENGINEERING
Inspect tool reach
Understand which operations become agent actions.
↗APPSECReview blast radius
Find sensitive capability and authorization signals.
↗DEVSECOPSGate contract changes
Turn capability deltas into CI policy.
↗API TEAMSImprove the contract
Make intended access clearer before integration.
↗Technical trust
Local by default. Explicit about what static analysis can’t prove.
OpenAPI files stay on your machine during static analysis. Outputs are deterministic and structured. Runtime reachability, effective IAM, and safe agent execution still require runtime evidence and human judgment.
01Local-first input
The source OpenAPI file is not uploaded for static analysis or entitlement verification.
02Exact entitlements
Product access is verified independently. Signed Stripe webhooks activate billing records and grants.
03Bounded conclusions
Findings and verdicts describe the declared contract, not production enforcement.
06Commercial entry
Start free. Buy only the decision layer you need.
OpenAPI Security Free and Pro are separate from the four one-time Agent Security offers. Checkout remains authoritative for the final total and applicable taxes.
Free $0 · Pro $19.99/mo
Start with local Free checks. Upgrade separately for the monthly Pro scanner feature set.
Open pricingOne-time products from $99
Capability Mapper $99, Agent API Readiness $199, Integration Gate $249, or the exact three-product Suite $399.
Compare Agent Security07FAQ
Clear answers before you connect an agent.
The scope is static and contract-level by design.
01What is Speculynx?+
Speculynx is a local-first security CLI for AI-connected APIs. It analyzes declared OpenAPI 3.0 and 3.1 contracts to map agent-accessible capabilities, surface readiness signals, compare risky capability changes, and review OpenAPI security signals.
02Does Speculynx upload my OpenAPI file?+
No. Static analysis runs locally. License and entitlement verification does not send the source OpenAPI document to Speculynx. Optional audit synchronization sends a bounded result, not the source file.
03Does a PASS prove runtime security?+
No. Speculynx analyzes declared contract information. It does not prove runtime reachability, IAM enforcement, prompt-injection resistance, or safe agent execution.
04What is included in Agent Security Suite?+
Exactly Capability Mapper, Agent API Readiness, and Integration Gate. The Suite grants those three product entitlements and no hidden fourth capability.
05Is Speculynx Pro the same as Agent Security?+
No. Pro is the OpenAPI Security subscription. Agent Security products are separate one-time purchases with separate entitlements.
SPECULYNX / GET STARTED
Inspect the contract before you hand it to an agent.
Start with local analysis. Move into Agent Security when you need capability mapping, readiness review, or change gating.