Timps API Security Tester — Security agent for Claude Code
Run an OWASP API Security Top-10 (2023) audit against an OpenAPI spec or live endpoint — broken auth, BOLA, mass assignment, rate-limit, SSRF, injection — with a runnable test harness.
How to install Timps API Security Tester
Installs to ~/.claude/agents/sandeeprdy1729-timps-swarm-timps-api_security_tester.md
mkdir -p ~/.claude/agents && curl -fsSL https://raw.githubusercontent.com/Sandeeprdy1729/timps-swarm/HEAD/.claude/agents/timps-api_security_tester.md -o ~/.claude/agents/sandeeprdy1729-timps-swarm-timps-api_security_tester.md Restart Claude Code, or start a new session, for it to be picked up.
What Timps API Security Tester does
name: timps_api_security_tester description: "Run an OWASP API Security Top-10 (2023) audit against an OpenAPI spec or live endpoint — broken auth, BOLA, mass assignment, rate-limit, SSRF, injection — with a runnable test harness. Use the `timps_api_security_tester` MCP tool to perform this task. Do not answer directly — delegate to this sub-agent." category: expert tools: ["mcp__timps-swarm__timps_api_security_tester"] model: sonnet
api security tester
You are the **api security test
Alternatives in Security
- Retool Endpoint Audit — Checks a migration slice against the main app's API surface — whether a local implementation duplicates an exi 7.2k ★
- API Attacker — API security testing specialist for REST, GraphQL, gRPC, and WebSocket APIs 72 ★
- Auth Reviewer — Authentication and authorization security reviewer 63 ★
Full documentation available on GitHub
View Source RepositoryRelated Agents
Kavach API
KAVACH API security + auth/session specialist. Traces every endpoint for BOLA/IDOR, BFLA, broken auth, mass as
Timps Accessibility Tester
Audit a frontend (HTML / React / Vue) for WCAG 2.2 AA & AAA issues — colour contrast, ARIA, keyboard nav, focu
PM Security Review
Read-only security reviewer for Product Masters LMS diffs. Finds the input/actor that breaks auth, access, RLS
API Security Auditor
API endpoint security assessment for auth, injection, and rate limiting
Webvuln Surface
Builds the TESTABLE request surface for the active web-vuln tier from an ingested program. Merges the passive
Gate Contract
SPEC (not a runnable agent). Canonical output contract for every gate agent — code-reviewer, security-reviewer
Related Skills
API Security
API security audit (OWASP API Security Top 10 2023): BOLA/IDOR, broken authentication, broken object-property-
Sec Scan Auth
인증/인가/어뷰징 취약점 진단 — Auth Bypass / IDOR / Mass Assignment / Rate Limit / 멱등성 / 클라이언트 신뢰 로직 — scan_api.py + scan_
Hunt Access
Active IDOR / BOLA / BFLA / mass-assignment hunt for an ingested program. Consumes the webvuln-surface seeds +