AktoOpen-source API security testing

Akto is an open-source API security testing platform maintained by the akto-api-security organization. It is aimed at security teams that need to keep an inventory of their APIs, test for known vulnerabilities, and investigate problems that appear at runtime. The project is released under the MIT license.

What Akto covers

The project centers on three connected tasks rather than a single scanning workflow:

• Building and maintaining an API inventory
• Running business-logic tests in CI/CD pipelines
• Finding runtime vulnerabilities and sensitive-data issues

According to the official repository, Akto covers multiple risk categories from the OWASP Top 10 and HackerOne Top 10. Examples include broken object-level authorization (BOLA), authentication flaws, SSRF, XSS, and security misconfiguration.

Traffic-based testing

Akto’s testing engine reads traffic data to understand API traffic patterns. The project says this approach can help reduce false positives, though that claim comes from the official materials and actual results may depend on the environment.

Supported traffic sources include Burp Suite, AWS, Postman, GCP, and API gateways. This gives teams several ways to feed existing API activity into the platform.

Deployment options

The quick-start path uses Docker Compose. After cloning the repository, users can run docker-compose up -d on a machine with Docker and curl installed.

For cloud deployments, the project recommends opening port 9090 only in the security group and restricting access to the VPC or the local machine IP. It also recommends using a private subnet and avoiding exposure of the instance to the public internet.

What the public documentation shows

Akto’s official messaging says it can be started in 60 seconds, but that has not been independently verified. GitHub metadata also describes the project as an AI security platform for AI agents, LLMs, and MCP, while the current README primarily focuses on general API security. Public materials do not currently provide detailed pricing or enterprise-edition information. For teams looking for a self-hosted starting point for API security testing, Akto is a reasonable project to evaluate, with advanced usage documented separately at docs.akto.io.

Method: This page was prepared with AI assistance from the official site or repository, with key numbers automatically checked against that source. Features and pricing may change; verify them at the source. project repository/documentation