OWASP Noir

What it is

OWASP Noir, a CLI SAST tool that extracts an application's exposed endpoints (paths, methods, parameters, headers, cookies, source files) from source across 205 frameworks. It became an OWASP Foundation project in June 2024. Per the page, v1.0.0 shipped in May 2026, establishing a stable 1.x line and — importantly for anyone with existing tooling — a new verb-centric CLI structure, so scripts built against older invocations may need updating.

How it works

Run it against a source directory:

noir -b <source_dir>

Shadow APIs, deprecated routes, and undocumented handlers fall out of the same inventory pass — there is no separate mode to enable. For frameworks static rules don't cover (or one-off custom routing), Noir offers an LLM fallback you can point at OpenAI, Ollama, etc.

Two flags drive the AI-review use case the summary alludes to:

• --include callee — attaches the 1-hop functions each handler invokes, giving an LLM auditor the immediate call context.
• --ai-context — attaches aggregated per-endpoint review context: guards, callees, sinks, validators, and signals, so the LLM doesn't rediscover them.

The same inventory serves three consumers equally: human reviewers, LLM-based SAST agents, and DAST tools (ZAP, Burp Suite, Caido, and Gori — the last not named in the summary) either as a proxy target or via OpenAPI import.

What to do

• To evaluate: noir -h, then noir -b <source_dir> on a repo.
• For CI: the page confirms a GitHub Action, SARIF output, and exit codes are available, so it can gate an existing pipeline.
• Feed the OpenAPI/SARIF export into your DAST tool to reach routes crawling would miss.

Caveats

The 205-framework figure is static-rule coverage; anything outside it depends on the LLM fallback, whose accuracy the page doesn't quantify. The roadmap itself frames per-framework accuracy as an ongoing effort ("keep accuracy honest with per-framework fixtures"), so treat the endpoint inventory as high-recall input for review, not a verified complete map.