Java API scanner that reads traffic to cut false positives

What it does

Akto is an open-source API security platform built in Java. It collects traffic from sources like AWS, Burp Suite, Postman, and gateways to build a live API inventory, then runs tests for OWASP API Top 10 and HackerOne Top 10 issues such as BOLA, SSRF, and authentication flaws. A standalone CLI and CI/CD integration let you automate testing outside the web dashboard.

The interesting bit

Rather than spraying payloads blindly, Akto’s testing engine analyzes actual traffic patterns to understand business logic, which it claims reduces false positives. That is a sensible approach in a space dominated by noisy scanners.

Key highlights

• Ingests traffic from Burp Suite, AWS, GCP, Postman, and API gateways to auto-discover endpoints
• Tests cover OWASP API Top 10 and HackerOne Top 10 categories, including BOLA and SSRF
• Java backend with MongoDB, Vue.js frontend, and a Docker Compose quick-start
• Standalone CLI (akto-api-testing-cli) for running tests in pipelines
• MIT licensed with an active public roadmap

Caveats

• The repository description and topics heavily market AI agent, LLM, and MCP security, but the README focuses almost entirely on traditional REST API scanning with no visible detail on AI-specific features.
• Manual development setup requires Java 8, Node 18+, Maven, and MongoDB—hardly a single-binary deployment.
• Dashboard screenshots and conference badges date to 2023, suggesting the visible documentation may not reflect recent pivots.

Verdict

Security teams managing large REST API footprints and looking for a traffic-aware, open-source scanner should take a look. If you need dedicated LLM or MCP guardrails, the README offers little evidence that Akto is already there—despite what the repo tags suggest.