CollectionForge

Deterministic contract-level security-posture analysis for OpenAPI 3.x mapped to OWASP API Security Top 10 2023. Checks documented authentication and authorization gaps, credential transport, resource bounds, privileged inputs, sensitive responses, server transport, and inventory hygiene. It never contacts the target API or fetches remote references.

Generates an importable Postman Collection 2.1 from a parsed OpenAPI 3.x document. Samples required inputs and JSON bodies, resolves local references, adds status assertions and authentication variables, and isolates state-changing requests in a review folder. It never executes the target API.

Deterministic parsed Docker Compose runtime analysis for privileged execution, host namespace and device access, capabilities and confinement, runtime user and filesystem controls, literal secrets, public ports, host mounts, image and build immutability, resource limits, health, logging, and external resources. It never contacts Docker, reads env or host files, starts containers, pulls images, executes builds, or returns secret values.

Compares current and proposed OpenAPI 3.x documents and returns consumer-breaking operations, required-input changes, request and response schema incompatibilities, media-type removals, authentication changes, remediation, and a migration plan.

Deterministic Dockerfile analysis for build-secret persistence, base-image immutability, remote-download integrity, package-manager hygiene, unsafe permissions, and final-stage least privilege. It never builds an image, contacts a registry, reads build context, or returns secret values.

Deterministic AWS IAM JSON policy analysis for grammar, least privilege, wildcard actions and resources, public and federated principals, sensitive conditions, PassRole escalation chains, MFA, and transport guardrails. It never loads AWS credentials, contacts AWS, simulates requests, or returns condition values.

Deterministic parsed Kubernetes manifest analysis against Baseline or Restricted Pod Security Standards plus RBAC least privilege, secret handling, immutable images, resource bounds, and network exposure. It never contacts a cluster, registry, admission controller, or runtime and never returns secret values.

Review caller-provided before and after CREATE TABLE SQL, detect destructive changes, map optional DataHub lineage blast radius, and return a verdict, safe expand-contract patch, and rollout plan.

Generates a standalone k6 smoke/load-test script from a parsed OpenAPI 3.x document. Samples required inputs and JSON bodies, resolves local references, supports configurable VUs and duration, uses environment-based auth, and gates write requests behind an explicit opt-in. It never executes the target API.

Generates a runnable TypeScript MCP stdio server from a parsed OpenAPI 3.x document using the stable MCP SDK v1. Creates one Zod-validated tool per operation with parameter/body handling, environment-only authentication, annotations, npm files, and MCP client config. It never executes the target API.

Generates WireMock mapping files and Docker Compose from a parsed OpenAPI 3.x document. Matches path patterns, required query/header/cookie inputs and JSON request bodies, and returns deterministic example responses. It never executes the target API.

Generates an importable Pact Specification V3 consumer-provider contract from a parsed OpenAPI 3.x document. Samples required inputs and JSON bodies, creates provider states, and supports configurable party names. It never executes the target API.

Deterministic risk analysis for terraform show -json plan output. Detects destructive deletes and replacements, public network exposure, broad IAM, disabled encryption and recovery safeguards, privileged workloads, resource drift, failed checks, and secret-handling risks. It never executes Terraform, contacts cloud APIs, or returns planned values.

Generates runnable JavaScript API tests for @playwright/test from a parsed OpenAPI 3.x document. Samples required inputs and JSON bodies, resolves local references, uses environment-based authentication, asserts documented responses, and gates state-changing tests behind RUN_WRITE_TESTS. It never executes the target API.

Combined commercial production verdict across release artifacts and an x402 provider webhook and registration boundary, returning full secret-safe component reports without executing code or contacting targets.

Unified deterministic release gate across Dockerfile, Docker Compose, Kubernetes, GitHub Actions, Terraform plan, AWS IAM, CloudFormation, and OpenAPI artifacts. Returns one verdict, prioritized findings, approval gates, and complete secret-safe component reports without contacting or executing deployment targets.

Generates a dependency-free, strictly typed TypeScript fetch SDK from a parsed OpenAPI 3.x document. Emits schema declarations, typed inputs and responses, parameter and JSON-body handling, authentication hooks, and ready npm project files. It never executes the target API.

Deterministic parsed AWS CloudFormation template analysis for sensitive parameters and outputs, embedded IAM, public network exposure, encryption, recovery and lifecycle controls, custom execution boundaries, artifact immutability, and IMDSv2. It never loads AWS credentials, contacts AWS, executes transforms, deploys a stack, or returns secret values.

Generates a standalone pytest/httpx module from a parsed OpenAPI 3.x document. Samples required inputs and JSON request bodies, resolves local references, uses environment-based auth, and gates state-changing tests behind an explicit opt-in. It never executes the target API.

Deterministic non-executing x402 provider webhook and registration-source review for HMAC, replay, callback allowlisting, redirect refusal, input bounds, idempotency, secret handling, service binding, and bounded registration spending.

Deterministic GitHub Actions workflow YAML analysis for privileged trigger trust boundaries, script injection, GITHUB_TOKEN least privilege, immutable action pinning, self-hosted runner exposure, secret delegation, OIDC gates, and untrusted artifacts. It never accesses GitHub, checks out code, executes a workflow, or returns credential values.

Generates stable Zod 4 runtime validators and inferred TypeScript types from a parsed OpenAPI 3.x document. Covers component schemas, operation inputs, successful JSON responses, formats, constraints, unions, intersections, and nullability. It never executes the target API.

Deterministic buyer-side preflight for captured x402 v1/v2 challenges. Checks exact scheme, Base network, USDC asset, recipient substitution, atomic amount budget, timeout, HTTPS binding, signing metadata, and optional Bazaar discovery without contacting a resource or wallet.

Instant integrity-checked ZIP containing secure webhook templates, replay and idempotency controls, registration spending guards, schemas, tests, a threat model, and a production security checklist.

Instant integrity-checked production ZIP with an audit CLI, secure provider sample, CI security gate, incident runbook, security checklist, and settlement reconciliation procedure.