static analysis · 8 frameworks · zero config

Find shadow APIs
your docs forgot.

Static shadow API detection for Express, NestJS, Spring Boot, Rails, Grape, and 3 more frameworks. Zero config. CI-native. Exit codes your pipeline understands.

$ npm install -g shadowaudit copied

see how it works →

scroll

npm downloads

Fetched live from the npm registry.

tests passing

Across 26 test files. Zero failures.

frameworks

Express · NestJS · Spring Boot · Rails · Grape · Django · Flask · FastAPI

0% FP

false-positive rate

Validated on Spring PetClinic. 17/17 routes detected correctly.

supported frameworks

Express.jsAST · 3-level DFS router graph

NestJS@Controller · @Version() decorators

Spring Boot@RestController · @PreAuthorize

Railsroutes.rb · concern expansion

Grapelib/api/*.rb · 1,017 GitLab routes

Djangopath() · DRF · class-based views

Flask@app.route · Blueprint url_prefix

FastAPIdecorators · include_router

how it works

Three steps from source code to shadow route report.

01 — Point

Point it at your spec

Pass your OpenAPI file. shadowaudit reads your documented surface and builds a route map. No server running. No traffic needed.

shadowaudit --spec ./openapi.yml

02 — Scan

Static analysis, zero runtime

Crawls your framework's route declarations at AST level. 495 tests across 26 files ensure precision. What your code exposes versus what your spec says — compared exactly.

✓ 495 tests ✓ 0 failures exit 0

03 — Surface

Get your ghost routes

Every route your code exposes but your spec doesn't mention. Table, JSON, SARIF, or Markdown. CI-native with exit codes 0/1/2 your pipeline understands.

--format sarif --fail-on critical exit 1

live output real scan

shadowaudit — terminal

$ shadowaudit --dir ./src --spec openapi.json --format table

loading spec: openapi.json (OpenAPI 3.x · 84 paths documented)

scanning Express router graph (3-level DFS)...

framework detected: Express 4.x

✓ Found 88 routes in ./src

Spec contains 84 documented routes

────────────────────────────────────────────────────────

GET /api/v2/admin/users/export [undocumented]

POST /api/internal/config/reset [undocumented]

GET /api/v1/debug/heap-snapshot [undocumented]

DELETE /api/admin/tokens/purge-all [undocumented]

────────────────────────────────────────────────────────

4 shadow APIs found · 84 spec paths · 88 actual routes

exit code 1

pricing

Free forever. Pay for collaboration.

—

Free

$0/mo

MIT forever. No strings.

Full CLI — all 8 frameworks
495 tests, all passing
Table, JSON, SARIF output
CI/CD · exit codes 0/1/2
Web dashboard
Zombie API detection
Team collaboration