akto-api-security/akto

Akto is the fastest growing AI Security platform for your teams to secure AI agents, MCPs, LLMs, Agent skills, Gen AI apps in your organization.

What it solves

Akto is an open-source API security platform designed to help security and engineering teams identify and fix vulnerabilities in their APIs. It addresses the gap in API visibility and testing by providing a continuous inventory of all APIs and detecting runtime issues and business logic flaws that traditional security tools often miss.

How it works

Akto integrates with various traffic sources—such as AWS, GCP, Postman, and Burp Suite—to analyze API traffic patterns. It uses this traffic data to build an automated API inventory and run a variety of business logic tests. By understanding how the API is actually used, the platform reduces false positives when testing for vulnerabilities like BOLA, SSRF, and XSS.

Who it’s for

This tool is primarily for security teams and software engineers who need to maintain a secure API ecosystem and integrate security testing into their CI/CD pipelines.

Highlights

  • Comprehensive Coverage: Supports OWASP Top 10 and HackerOne Top 10 API security categories.
  • Traffic-Driven Testing: Reads real traffic data to understand patterns and run more accurate business logic tests.
  • CI/CD Integration: Allows teams to run security tests as part of their deployment pipeline.
  • Broad Integration: Connects with multiple traffic sources including cloud providers and API gateways.

Related

  • Project
    Kritt-ai/open-kritt

    An open-source security research platform that orchestrates AI agents to find, validate, and rank vulnerabilities in code through focused, parallelized workflows.

  • Project
    lintsinghua/DeepAudit

    DeepAudit is an open‑source, multi‑agent AI security auditor that analyses code, generates and sandbox‑executes PoC exploits, and outputs professional reports. It runs via Docker, supports local LLMs, and aims to reduce false positives and verify vulnerabilities automatically.

  • Project
    agno-agi/agno

    Agno is a framework and runtime for building and managing agent platforms, providing an SDK, a runtime engine, and a management UI to maintain full control over the agent stack.

  • Project
    arcjet/arcjet-js

    A runtime security platform for AI applications that detects prompt injection, manages token budgets, and blocks bots and sensitive data leaks.

  • Project
    promptfoo/promptfoo

    A CLI and library for evaluating and red-teaming LLM applications to replace trial-and-error prompt engineering with data-driven testing and security scanning.