security

API Security Audit

Audit your API for security issues: missing auth, exposed sensitive data, insecure transport, weak validation, and OWASP API Security Top 10 alignment. Works with local OpenAPI specs and Postman collections.

Prerequisites

For collection auditing, the Postman MCP Server must be connected. Local spec auditing works without MCP. If needed, tell the user: "Run /postman:setup to configure the Postman MCP Server."

Workflow

Step 1: Find the Source

Call getWorkspaces to get the user's workspace ID. If multiple workspaces exist, ask which to use.

Local spec:

• Search for **/openapi.{json,yaml,yml}, **/swagger.{json,yaml,yml}

Postman spec (via MCP):

• Call getAllSpecs with the workspace ID to find specs
• Call getSpecDefinition for the full spec content

Postman collection (via MCP):

• Call getCollections with the workspace parameter
• Call getCollection for full detail including auth config
• Call getEnvironment to check for exposed secrets

Step 2: Run Security Checks

Authentication and Authorization:

• Security schemes defined (OAuth2, API Key, Bearer, etc.)
• Security applied globally or per-endpoint
• No endpoints accidentally unprotected
• OAuth2 scopes defined and appropriate
• Admin endpoints have elevated auth requirements

Transport Security:

• All server URLs use HTTPS
• No mixed HTTP/HTTPS

Sensitive Data Exposure:

• No API keys, tokens, or passwords in example values
• No secrets in query parameters (should be headers/body)
• Password fields marked as format: password
• PII fields identified
• Postman environment variables checked for leaked secrets (via getEnvironment)

Input Validation:

• All parameters have defined types
• String parameters have maxLength
• Numeric parameters have minimum/maximum
• Array parameters have maxItems
• Enum values used where applicable
• Request body has required field validation

Rate Limiting:

• Rate limits documented
• Rate limit headers defined (X-RateLimit-Limit, X-RateLimit-Remaining)
• 429 Too Many Requests response defined