tester-army/scout

Scout is a command line tool for testing web APIs, built specifically to be driven by AI coding agents rather than by a person typing commands. It reads an OpenAPI specification, sends real requests against your API, and records structured findings and coverage reports so an agent can check whether an API works correctly before it gets deployed. The typical workflow is to install a bundled skill file into a project with a single command, then hand an agent a prompt telling it to test the API through realistic user flows instead of checking each endpoint in isolation. The agent initializes Scout with the spec and any authentication header, runs a baseline sweep, walks through complete user flows, and investigates anything unusual using direct calls or fuzzing. Confirmed bugs get recorded as findings, and a final report summarizes coverage and results. Scout can also run without a spec at all, using just a base URL, though endpoint discovery and schema checks then require the full specification. Safety is a central design goal. By default Scout only sends GET requests, blocking POST, PUT, PATCH, and DELETE unless a user explicitly enables mutations. Every run is restricted to a single configured host, requests do not follow redirects to other hosts, and credentials in output are redacted. Rate limits and a total request budget cap how much traffic a run can generate, and these limits apply across every command in a session. Multiple authentication profiles can be defined for testing different user roles or tenant isolation. Findings from fuzzing start as candidates that a person or agent must confirm or dismiss before they can fail a continuous integration check, so unverified guesses cannot silently block a deployment. The report command can enforce a minimum coverage threshold and required checks when used as a CI gate. Scout is distributed as an npm package, written in TypeScript, and released under the MIT license, so it can be freely reused, including commercially.