Input
OpenAPI 3.0 or 3.1 contracts. Integration Gate takes a baseline and candidate.
Agent Security
See the API capabilities your agent could inherit.
Speculynx Agent Security is a three-stage static-analysis workflow for declared OpenAPI surfaces: map capabilities, review integration signals, and gate security-relevant changes.
01MAP → REVIEW → GATE
Three products. One capability-control workflow.
Each stage answers a different engineering question and produces deterministic terminal and JSON output.
01MAP
Capability Mapper
Translate documented operations into a deterministic capability inventory.
02REVIEW
Agent API Readiness
Combine capabilities and scanner signals into explicit integration review points.
03GATE
Integration Gate
Compare baseline and candidate contracts, then return PASS, REVIEW, or FAIL.
02Contract scope
Built around declared evidence.
The analysis uses documented operations, methods, security requirements, permission labels, schema reachability, and scanner signals. It does not connect an agent or test effective runtime enforcement.
Output
Versioned Agent Security 1.0 terminal and JSON results with explicit coverage.
Decision owner
The output informs human and CI policy; it does not approve deployment automatically.
Static-analysis boundary
Evidence for a decision, not proof of runtime safety.
Agent Security reasons about what the declared OpenAPI contract exposes. Runtime reachability, effective IAM enforcement, prompt-injection resistance, and safe agent execution require other evidence.
01Declared surface
Operations and contract metadata are the analysis boundary.
02Deterministic output
Terminal and JSON evidence is intended for technical review and CI policy.
03Explicit limits
A PASS is not a guarantee that an API or agent is secure at runtime.
LOCAL-FIRST REVIEW
Inspect the contract before the agent acts.
Start with a local OpenAPI review, then choose the Agent Security workflow that matches your decision.