agent.authzAuthentication & authorization review
Inventories every route and handler, then checks who can reach it and whose data it touches: missing auth, IDOR, tenant isolation, privilege escalation, sessions/JWT, password reset and rate limiting. (agentic, uses Claude)
- Engine
- Agent
- Targets
- Codebase
- Areas
- Security
- Runs
- Opt-in: only when selected with --only
- Network
- Contacts services beyond the target
Run only this auditor
bunx openaudit . --only agent.authzRuns a playbook with the Claude Agent SDK. Needs ANTHROPIC_API_KEY or a Claude Code login; host agents can run the same playbook over MCP without a key.
Playbook
Inventories every route and handler, then checks who can reach it and whose data it touches: missing auth, IDOR, tenant isolation, privilege escalation, sessions/JWT, password reset and rate limiting.
Host agents fetch it with get_playbook over MCP. How playbooks work