run_api_security_scan
v0.8.0 OWASP API Security Top 10 (2023) rule-based scanner — load an OpenAPI 3.x spec, walk path × method, dispatch 5 in-scope rules (API1 BOLA, API2 Broken Auth, API3 Mass Assignment, API5 Function-Level Authz, API8 Misconfig). Gated by QAAPISECURITYCONSENT=true + QAAPISECURITYAUTHORIZEDDOMAINS. Se
How to use it
run_api_security_scan is exposed by the Mk Qa Master MCP server. Add the server to your MCP client (Claude Desktop, Cursor, Windsurf and others), and the run_api_security_scan tool becomes available to the model automatically. See the full listing for setup details and every tool this server provides.
Install Mk Qa Master
pip install mk-qa-master # or: pip install -e . from a cloneOther tools in Mk Qa Master (14)
Mobile: maestro hierarchy → form / cta / tabbar modules + candidate TCs (noise-filtered)
Web: DOM probe → modules + selectors + candidate TCs + API endpoints + layout overflow warnings
One-shot: analyze URL → generate one test per discovered module
Launch Playwright codegen (web) / hint to maestro studio (mobile)
Render the latest run as self-contained HTML
Test skeleton; with module from analyzeurl/analyzescreen, a runnable one (Playwright .py or Maestro .yaml)
Per-failure message + screenshot / trace / video paths
Three-layer self-improvement coach (suite / MCP / AI strategy)
Which runner is active + all available ones
Last N archived run summaries (for trend / flake debugging)
Summary (pass / fail / skipped / duration / flaky-in-run)
Enumerate tests in the project
Re-run last failures (pytest --lf)
Run tests (filter / headed / browser; last two pytest-playwright only)