Test, triage and fix every app you ship.

Guides for scanning mobile apps, web apps and APIs, source code and networks, mapping your attack surface, and remediating what Ostorlab finds.

Search the docs /

Run your first scan API reference

Fail the build on critical findings

$ ostorlab --api-key="$OSTORLAB_KEY" ci-scan run \
    --scan-profile=full_scan \
    --break-on-risk-rating=high \
    android-apk app-release.apk
✓ Scan created
⋯ Static, dynamic and backend analysis
✓ Scan done. Risk rating: MEDIUM
✓ Build passes (threshold: HIGH)

Start here

What do you want to test?

Documentation

Browse by topic

Getting Started

Copilot

Scanning

All pages

Attack Surface

All pages

Policies & Remediation

Integrations & API

Organisation

Plans

Security & Privacy

Developers

Build on Ostorlab

Automate scanning and triage from your own code, or let an AI assistant work with your findings directly.

GraphQL API

The full platform surface: create scans, follow their progress, pull tickets and download reports.

$ curl -X POST https://api.ostorlab.co/apis/graphql_token/ \
    -H "X-Api-Key: $OSTORLAB_KEY" \
    -H "Content-Type: application/json" \
    -d '{"query": "{ scans { scans { id title progress } } }"}'

Open the API reference

MCP server

Typed tools that AI assistants discover and call on their own, for scans, vulnerabilities, tickets and assets.

$ claude mcp add --transport http ostorlab \
    https://api.ostorlab.co/apis/mcp/YOUR_API_KEY/

Set up the MCP server

Integrations

Scan on every build

Add Ostorlab to your CI/CD pipeline, fail builds on risky findings, and sync tickets with Jira, Linear or ServiceNow.

All integrations

Watch the platform walkthrough