• SECURITY
  • CLEANUP
  • AUDIT
  • HUMAN

How to find undocumented shadow APIs with your AI

Connect Levo.ai to your agent to surface hidden endpoints. Once connected, your AI handles the heavy lifting of scanning and auditing your API surface.

Ask AI about this page

Short answer

How do I find undocumented shadow APIs with my AI?

Your AI pulls the full list of endpoints from the Levo catalog and inspects their specific details to find discrepancies. It identifies zombie or shadow APIs that bypass your security controls. You get a clear list of risks to investigate.

Discovery outcomes

Where your findings land.

The AI organizes the results into these specific categories.

SECURITY

Shadow API alerts

The AI identifies endpoints that exist in the catalog but aren't in your official documentation. These are flagged as high-priority risks.

CLEANUP

Zombie endpoint lists

Your agent finds old, unused, or deprecated endpoints that are still active. This helps you shrink your attack surface.

AUDIT

Detailed endpoint specs

The AI pulls specific technical details for any suspicious endpoint it finds. You get the exact parameters and paths needed for investigation.

HUMAN

Manual review required

The AI flags the most dangerous mismatches for you. You decide whether to decommission the endpoint or update your documentation.

The workflow

What your AI does when the catalog is connected.

The AI acts as a bridge between your Levo data and your security reasoning.

  1. Catalog ingestion

    The AI pulls the complete list of all endpoints currently tracked in your Levo environment.

    list_catalog_endpoints

  2. Deep inspection

    It looks into the specific configuration and metadata of individual endpoints to find anomalies.

    get_endpoint_details

  3. Anomaly detection

    The agent compares the live endpoint data against your expected security posture to spot shadows.

    list_catalog_endpointsget_endpoint_details

  4. Risk reporting

    The AI summarizes the findings, highlighting which endpoints are most likely to be unauthorized or forgotten.

    get_endpoint_details

Try it

Copy these to start.

Use these prompts to kick off the discovery process.

Starting points

Swap the bracketed text for your specific environment names or endpoint paths.

Levo.ai Connector

You're all set. Choose your MCP client and follow the setup instructions.

Connector linkhttps://edge.vinkius.com/vk_preview_ocgOSKY6v8okp7FqhtNNryrgqK5w88K7ZxejLbQq/mcp

Claude Desktop

Follow the steps below to connect in seconds.

  1. 1In Claude Desktop, open Settings → Connectors.
  2. 2Click “Add custom connector” and paste the connector link above as the remote MCP server URL.
  3. 3Click Add and start a new chat — Levo.ai capabilities are ready to use.
Configuration · claude_desktop_config.jsonCopy
{
  "mcpServers": {
    "levoai-api-security-observability-mcp": {
      "url": "https://edge.vinkius.com/vk_preview_ocgOSKY6v8okp7FqhtNNryrgqK5w88K7ZxejLbQq/mcp"
    }
  }
}
Copy into chat04

  • List all endpoints in my Levo catalog and tell me which ones look undocumented.

  • Check the details for the [endpoint name] endpoint and see if it matches our security policy.

  • Find any zombie endpoints in the catalog that haven't been updated recently.

  • Compare the list of all endpoints with my known API documentation to find shadows.

  • Claude
  • ChatGPT
  • Cursor
  • VS Code
  • Windsurf
  • Claude Code
  • JetBrains
  • Cline

Start here

Connect Levo.ai once, then ask.

Just link your Levo account. Your credentials stay encrypted, and you can immediately start asking your agent about your API surface.

Connect Levo.ai to your AI

FAQ

How this task behaves.

  • 01

    Can the AI delete an endpoint for me?

    No. The AI can only read the catalog and inspect details. You must manually perform any deletions or changes in Levo.

  • 02

    Does the AI update my documentation automatically?

    No. The AI identifies the gaps, but you are responsible for updating your official API documentation.

  • 03

    How does the AI know an endpoint is a 'shadow'?

    It compares the live data it gets from the catalog against the context or documentation you provide in your chat.

  • 04

    Can I use this to scan endpoints not in the Levo catalog?

    No. The AI is limited to the data it can access through the provided tools in the Levo catalog.

  • 05

    Will the AI change my security settings?

    No. The tools only allow for reading and inspecting data, not modifying security configurations.

  • More questions about Levo.ai? See everything the Levo.ai Connector can do

Connect Levo.ai to Claude, Cursor, ChatGPT & more