Agent-ready workflow · client
JavaScript to API Authorization
Extract hidden operations and trust decisions from JavaScript, then validate one server-side authorization boundary with controlled identities.
Entry contract
Enter with artifacts, leave with evidence.
Use when
- large bundles
- undocumented API
- hidden mutation
- client role check
Prerequisites
- approved bundles or proxy history
- two controlled identities
- controlled object
MCP retrieval
Agents can search this workflow, retrieve the complete graph, or request one stage through the read-only Vulns.co MCP connector.
Inventory client artifacts
Hash and classify bundles, chunks, workers, source maps, and runtime configuration without executing untrusted files.
Inputs
- approved page URLs or local bundle folder
Outputs
- artifact manifest
- source-map inventory
- Evidence gate
- Every extracted lead points to a file hash and code location.
- Negative control
- Third-party library endpoints are separated from application-owned operations.
- Stop condition
- Never execute downloaded code to discover behavior.
Extract operations and guards
Map routes, GraphQL documents, RPC names, message types, feature flags, role checks, and object identifiers.
Inputs
- artifact manifest
Outputs
- operation catalog
- client trust decisions
- Evidence gate
- Each operation includes its source, method or message shape, and relevant identifiers.
- Negative control
- String literals with no reachable call site stay low confidence.
- Stop condition
- Do not treat a client guard as a server vulnerability.
Bind code to observed traffic
Find one real request or message that matches the extracted operation and record identity, tenant, object, and state.
Inputs
- operation catalog
- controlled traffic
Outputs
- normalized request pair
- role-object-action row
- Evidence gate
- The candidate operation is observed against a current in-scope endpoint.
- Negative control
- An obsolete or unreachable endpoint is rejected.
- Stop condition
- Stop if the operation cannot be reached with controlled identities.
Test one authorization dimension
Change only object, role, tenant, or action between two controlled accounts.
Inputs
- request pair
- controlled object
Outputs
- paired responses
- supported or rejected lead
- Evidence gate
- A reproducible non-owner read or reversible write crosses the expected boundary.
- Negative control
- Original owner and nonexistent object requests distinguish authorization from caching or object absence.
- Stop condition
- Use only controlled records and stop after sufficient proof.
Related methods
Continue with the right depth.
Sources