owasp-noir/noir

Health v2 · maintenance only

Adoption not part of the score

1383 stars · 148 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

OWASP Noir is a static analysis (SAST) CLI tool that scans source code to extract every endpoint an application exposes, including shadow APIs and undocumented routes, with paths, methods, parameters, headers, and cookies. It outputs to 22 formats (JSON, OpenAPI, SARIF, Postman) and feeds findings to human reviewers, LLM-based auditors, and DAST scanners like ZAP and Burp Suite.

Use cases

• discover all API endpoints in a codebase before a pentest
• find shadow APIs and undocumented routes in source code
• map the attack surface of a web application statically
• generate an OpenAPI spec from an existing codebase
• feed endpoint lists to ZAP or Burp Suite for DAST scanning
• give LLM security agents focused endpoint context for code review
• detect hardcoded secrets and credentials in source code

When to choose

• you need an inventory of attacker-reachable endpoints from source code without running the app
• your DAST scanner misses routes it can't crawl and you want to seed it
• you support many languages/frameworks and want one binary with no per-language setup
• you want SARIF or OpenAPI output for existing security tooling

When to avoid

• you need dynamic runtime testing of live endpoints rather than static analysis
• your stack is not among the 205 supported frameworks and you can't use LLM fallback
• you want full SAST coverage of business logic vulnerabilities beyond endpoint extraction

Facets

cli-tool · maturity active

security vulnerability-scanning parser static-site-generator developer-tools security penetration-testing developer-tools apis cli cross-platform windows sast endpoint-discovery attack-surface-mapping shadow-api api-security dast-integration openapi-export sarif owasp crystal devops linux macos

Member repositories

For agents

markdown · JSON · MCP: product_card(name="owasp-noir/noir")