# owasp-noir/noir

Hunt every Endpoint in your code, expose Shadow APIs, map the Attack Surface.

Repository: https://github.com/owasp-noir/noir
Canonical: https://ross.abutalabs.com/products/owasp-noir-noir
Homepage: https://owasp-noir.github.io/noir/
Language: Crystal
License: MIT
License Family: permissive
Topics: attack-surfaces, pentesting, security, devsecops, hacktoberfest, owasp, owasp-noir, endpoints, api-security, shadow-api, crystal
Last push: 2026-08-26T16:15:39+00:00

## Health v2 (maintenance only)
Score: 99/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 99, release rhythm 98, longevity 100
- inputs: {"age_days": 1642, "days_push": 7, "days_rel": 15, "gap_med": 25, "n_releases_24m": 28}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1383, forks 148 (observed 2026-08-28T04:04:34.546018+00:00)

## What it is
OWASP Noir is a static analysis (SAST) CLI tool that scans source code to extract every endpoint an application exposes, including shadow APIs and undocumented routes, with paths, methods, parameters, headers, and cookies. It outputs to 22 formats (JSON, OpenAPI, SARIF, Postman) and feeds findings to human reviewers, LLM-based auditors, and DAST scanners like ZAP and Burp Suite.

## Use cases
- discover all API endpoints in a codebase before a pentest
- find shadow APIs and undocumented routes in source code
- map the attack surface of a web application statically
- generate an OpenAPI spec from an existing codebase
- feed endpoint lists to ZAP or Burp Suite for DAST scanning
- give LLM security agents focused endpoint context for code review
- detect hardcoded secrets and credentials in source code

## When to choose
- you need an inventory of attacker-reachable endpoints from source code without running the app
- your DAST scanner misses routes it can't crawl and you want to seed it
- you support many languages/frameworks and want one binary with no per-language setup
- you want SARIF or OpenAPI output for existing security tooling

## When to avoid
- you need dynamic runtime testing of live endpoints rather than static analysis
- your stack is not among the 205 supported frameworks and you can't use LLM fallback
- you want full SAST coverage of business logic vulnerabilities beyond endpoint extraction

## Facets
- artifact type: cli-tool
- maturity: active
- function: security, vulnerability-scanning, parser, static-site-generator, developer-tools
- domain: security, penetration-testing, developer-tools, apis
- platform: cli, cross-platform, windows
- tags: sast, endpoint-discovery, attack-surface-mapping, shadow-api, api-security, dast-integration, openapi-export, sarif, owasp, crystal, devops, linux, macos

## Member repositories
- owasp-noir/noir (main) score 99

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:04:34.546018+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T04:40:03.571494+00:00, confidence not recorded.
  - readme: https://github.com/owasp-noir/noir (fetched 2026-08-28T04:04:34.546018+00:00, sha 7017b0643a35)
  - homepage: https://owasp-noir.github.io/noir/ (fetched 2026-08-29T11:55:44.631316+00:00, sha 4da40cb86a87)
- Data as of 2026-08-30T08:39:29.467469+00:00.