Coup de Grâce

Find What Breaks Before Someone Else Does

Security scanning for websites, APIs, and AI agents. Our agents attack your target the way a real attacker would, safely, and tell you exactly what to fix.

Start a Scan
What We Test For
AI Agents / MCP Servers

This is the part nobody else does. If you're deploying an AI agent or MCP server, we test it the way an attacker would:

  • Prompt injection (7 different attack vectors)
  • System prompt extraction
  • Tool misuse and permission escalation
  • Data exfiltration through tool calls
  • Context window poisoning
  • Excessive autonomy (will it act without asking?)

To scan an agent, enter its chat/completions endpoint (the URL your agent listens on for messages). We send it test prompts and analyze the responses.

Websites
SQL Injection XSS CORS Security Headers Exposed Files SSRF Open Redirects TLS / SSL Cookies Clickjacking
APIs
BOLA Auth Bypass Rate Limiting JWT Misconfig Mass Assignment GraphQL Introspection
How It Works
1
Enter Your Target

Paste the URL of your website, API endpoint, or AI agent. For agents, this is the endpoint that accepts chat messages (like /v1/chat/completions or your MCP server URL).

2
Agents Run the Tests

Our scanning agents probe your target using real attack techniques. Everything is non-destructive: we don't delete data, we don't take things offline, we don't store what we find beyond the report.

3
Get Your Report

Every vulnerability is ranked Critical / High / Medium / Low with proof it's real and a specific fix. Download the full report as markdown and share it with your team.

Connecting an AI Agent

If you're running an AI agent or MCP server, here's how to set it up for scanning:

1. Find Your Agent's Endpoint

This is the URL where your agent accepts messages. Common formats:

https://your-app.com/v1/chat/completions    (OpenAI-compatible)
https://your-app.com/v1/messages             (Anthropic-compatible)
https://your-app.com/api/chat                (Custom)
mcp://your-server.com                        (MCP protocol)
2. Make Sure the Endpoint Is Reachable

The scanner needs to send HTTP POST requests to your agent. If it's behind auth, the scan will test that too (checking if unauthenticated access is possible is one of the tests).

3. Select "AI Agent / MCP" as the Scan Type

This runs the agent-specific checks: prompt injection, system prompt extraction, tool misuse, data leakage, and more. The scanner sends carefully crafted messages and analyzes what your agent does with them.

4. What the Scan Looks For

Can someone extract your system prompt by asking nicely? Can they trick your agent into reading files it shouldn't? Will it execute commands if asked? Does it leak environment variables? Will it take destructive actions without confirming? These are the things we test.

Run It Locally

Don't want to use the website? Install the CLI and run scans from your own machine. Same tests, your hardware, nothing leaves your network.

npm install -g coup-de-grace

coupde https://your-site.com
coupde https://your-site.com --type web -f json -o report.json
coupde https://your-agent.com/chat --type agent
coupde https://api.example.com/v1 --type api
coupde https://example.com --type infra

The scanner pulls from a vulnerability database updated from OWASP, CISA, CVE feeds, and real-world incidents.

View Source and Docs on GitHub