Lists every endpoint your app exposes and tells you which ones will accept garbage, leak errors or get abused.
Maps every HTTP route, Route Handler, server action and webhook, then checks input validation, rate limiting, CORS, error leakage, mass assignment and file upload handling on each one.
1 skills · 2 MCP servers · 4 settings
API Surface Reviewer builds the list of every way a request can reach your server code: Next.js Route Handlers and server actions, Express and Hono routes, Pages Router API routes, Supabase Edge Functions, webhooks and cron handlers. For each one it checks what a hostile caller can do: send a body that was never validated, set fields they should not control (mass assignment), call it ten thousand times a minute, call it from any website (CORS), read a stack trace or an ORM error, upload a file of any type and size, or spoof a webhook.
It is written for apps built quickly on Next.js, Supabase, Express, Prisma and Vercel. Every finding has a file and line, the request that would trigger it, and a fix in the libraries the app already uses (zod, valibot, upstash ratelimit, the framework's own CORS and error handling).
It reads files only. Give it the app root and, if you know them, the browser origins that are meant to call the API.