The most popular API client. Essential for manual testing, organizing collections, and automating requests.

brew install --cask postman

The industry standard web proxy. Use it to intercept, modify, and scan API traffic.

# Download from website

A high-performance API content discovery tool. Excellent for finding hidden endpoints.

# No Homebrew formula — use a release binary, or build from source:
git clone https://github.com/assetnote/kiterunner && cd kiterunner && make build

HTTP parameter discovery suite. Finds hidden query parameters in API endpoints.

pip3 install arjun

Fast web fuzzer written in Go. Great for directory and endpoint discovery.

go install github.com/ffuf/ffuf/v2@latest

A toolkit for testing, tweaking, and cracking JSON Web Tokens (JWTs).

git clone https://github.com/ticarpi/jwt_tool && cd jwt_tool && pip3 install -r requirements.txt

Automatic SQL injection and database takeover tool. Works well on API endpoints.

brew install sqlmap

A Burp Suite extension for GraphQL security testing. Introspection, scanner, and more.

# Install via Burp BApp Store

Like curl, but for gRPC. Interact with gRPC servers from the command line.

brew install grpcurl

In-depth attack surface mapping and asset discovery.

brew install amass

Fast, template-based vulnerability scanner. Has hundreds of API-specific templates for common misconfigurations and CVEs.

go install github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest

Modern web security proxy — a lightweight Burp Suite alternative with a clean UI, built-in replay, and HTTPQL query language.

# Download from caido.io

Security auditing tool for GraphQL. Checks introspection, batching, field suggestions, persisted queries, and DoS vectors.

git clone https://github.com/dolevf/graphql-cop && cd graphql-cop && pip3 install -r requirements.txt

Interactive TLS-capable intercepting proxy. Scriptable in Python. Excellent for automated API traffic manipulation and gRPC interception.

brew install mitmproxy

User-friendly HTTP client for the terminal. Great for quick manual API testing with readable output and session support.

brew install httpie

Property-based API testing powered by OpenAPI/GraphQL schemas. Automatically generates test cases from your spec and finds edge cases scanners miss.

pip3 install schemathesis

Microsoft's stateful REST API fuzzer. Infers producer-consumer dependencies from Swagger specs and generates intelligent sequences of API calls. Needs Python 3.12 and the .NET 8 SDK to build — RESTler is not published as a NuGet tool.

# Requires Python 3.12 and the .NET 8 SDK
git clone https://github.com/microsoft/restler-fuzzer && cd restler-fuzzer
python3.12 ./build-restler.py --dest_dir restler_bin

Unmaintained — last release was October 2023 and the repository has been idle since. Kept here because it still runs: a CLI tool for API security validation that checks OpenAPI specs for OWASP API Top 10 risks, broken auth, excessive data exposure, and missing rate limits.

cargo install cherrybomb

Reconstruct GraphQL schemas when introspection is disabled by exploiting field suggestion error messages.

pip3 install clairvoyance

WebSocket client for the terminal. Connect, send messages, and test WebSocket APIs from the command line.

npm install -g wscat