Four deterministic checks
KEY-EXP-01 · Query-parameter keys or tokens
HTTP-001 · Insecure server URLs
AUTH-001 · Missing documented authentication
KEY-EXP-02 · Undocumented static-key lifetime or rotation
OpenAPI Security
Catch contract-level security gaps before runtime.
Speculynx scans OpenAPI 3.0 and 3.1 files locally, returns deterministic findings and explicit coverage, and keeps every conclusion scoped to the declared contract.
01Free → Pro
Start with four local controls. Expand with ten Pro heuristics.
Free works without a license or backend connection. Pro adds heuristic coverage, PDF export, and bounded live checks.
Install Free
Ten additional heuristics
Review authorization, object access, rate limiting, data exposure, and other contract signals with explicit rule execution and coverage metadata.
Pro also adds PDF output and a bounded scan-live mode. It remains separate from Agent Security.
02Output contract
A finding is a signal to verify.
JSON schema 1.0 reports executed, skipped, and non-evaluated rules; per-control status; findings; coverage; and verdict.
$ speculynx scan --file openapi.yaml --json
schema_version1.0
coverage.statuspartial
findingAUTH-001
verdictindeterminate
Static-analysis boundary
No finding is not proof of security.
Static analysis does not prove absence of vulnerabilities, live reachability, runtime authorization enforcement, exploitability, or production safety. A no-finding Free result is indeterminate, not “secure.”
Read the technical trust model →FREE $0 · PRO $19.99/MO
Run your first contract review locally.
Install from PyPI and scan an OpenAPI 3.0 or 3.1 file without uploading it. Pro remains separate from all Agent Security purchases.