Captured from the live deployment, not a mockup
01 · The problem
Autonomy only sells if it is accountable. Framed an agentic testing platform around one rule: an agent may act, but only through 19 schema-validated tools, each granted per host and audited.
02 · How it works
- 01
Scoped it to the gap teams actually have, functional tests in one product and security tests in another, generating both from a URL and plain-English intent.
- 02
Defined what counts as a finding rather than letting the model decide, comparing 8 OWASP API Top 10 families against a benign baseline. 674 tests gate every change.
- 03
Built an API testing and security platform on Node.js and MCP that turns a URL and plain-English intent into executable test cases with status, JSONPath, header and body assertions, grounded in an imported OpenAPI 3.1 document.
- 04
Designed the tool layer as 19 Zod-validated tools across 6 risk classes with per-host grants, a filesystem jail and a process sandbox, and isolated state-mutating endpoints so a test run cannot corrupt the target.
03 · What it cost, and what it returned
Covered the system with 674 tests in CI and tied test-generation confidence to the handler source rather than to the model's own assertion.