• SHADOW
  • ZOMBIE
  • RISK
  • HUMAN

How to discover shadow and zombie APIs with your AI

Connect Salt Security to your AI client to turn your API inventory into a searchable map of hidden risks. Once connected, your agent handles the heavy lifting of scanning for endpoints you didn't know existed.

Ask AI about this page

Short answer

How can I find shadow and zombie APIs using my AI?

Your AI uses the Salt Security inventory to identify endpoints that are either undocumented or no longer in use. It compares your active traffic against your known documentation to highlight these gaps. You'll get a clear list of specific endpoints that need attention.

Where every issue lands.

The outcomes of your scan

The AI categorizes every discovery into specific buckets for your security workflow.

SHADOW

Undocumented endpoints

The AI flags APIs that appear in your traffic but aren't in your official documentation. You get a list of these hidden entry points.

ZOMBIE

Inactive or old endpoints

Your agent identifies legacy endpoints that are still active but shouldn't be. This helps you clean up your attack surface.

RISK

Vulnerability mapping

The AI correlates shadow APIs with known weaknesses. You receive a prioritized list of which undocumented endpoints are most dangerous.

HUMAN

Manual review required

The AI identifies suspicious patterns that require a security engineer to investigate. You decide if these warrant a formal incident response.

The workflow

What your AI does when the inventory is ready.

The AI acts as a bridge between your raw security data and your investigation process.

  1. Pulling the data

    Your agent pulls the latest list of all discovered endpoints from your security platform.

    get_inventory

  2. Identifying gaps

    The AI compares the live inventory against your expected API definitions to find mismatches.

    get_inventory

  3. Classifying threats

    It labels each mismatch as either a shadow API or a zombie API based on usage patterns.

    get_inventory

  4. Reporting findings

    The agent organizes these findings into a readable summary for your security review.

    get_inventory

Try it

Copy these to start.

Use these prompts to kick off your investigation.

Starting points

These are just ways to start the conversation. Swap out the specific endpoint names or categories to match your actual environment.

Salt Security Connector

You're all set. Choose your MCP client and follow the setup instructions.

Connector linkhttps://edge.vinkius.com/vk_preview_HEqpwxZCJGloy9SZRikbBjYA9GqrD7wwt82MwMIn/mcp

Claude Desktop

Follow the steps below to connect in seconds.

  1. 1In Claude Desktop, open Settings → Connectors.
  2. 2Click “Add custom connector” and paste the connector link above as the remote MCP server URL.
  3. 3Click Add and start a new chat — Salt Security capabilities are ready to use.
Configuration · claude_desktop_config.jsonCopy
{
  "mcpServers": {
    "salt-security-mcp": {
      "url": "https://edge.vinkius.com/vk_preview_HEqpwxZCJGloy9SZRikbBjYA9GqrD7wwt82MwMIn/mcp"
    }
  }
}
Copy into chat04

  • Show me all the shadow APIs found in the Salt Security inventory.

  • List any zombie APIs that haven't seen traffic in the last 30 days.

  • Which undocumented endpoints in the inventory are currently receiving high traffic?

  • Summarize the most critical zombie APIs from the latest inventory pull.

  • Claude
  • ChatGPT
  • Cursor
  • VS Code
  • Windsurf
  • Claude Code
  • JetBrains
  • Cline

Start here

Connect Salt Security once, then ask.

You only need to link your account once. Your credentials stay encrypted, and you can immediately start asking your AI about your API security posture.

Connect Salt Security to your AI

FAQ

How this task behaves

  • 01

    Can the AI delete an API endpoint?

    No. The AI can only read your inventory and identify issues. It cannot modify or delete anything in Salt Security.

  • 02

    Does the AI automatically fix shadow APIs?

    No. The AI identifies the gaps, but you have to manually update your documentation or decommission the endpoints yourself.

  • 03

    How does the AI know if an API is a zombie?

    It looks at the activity data provided by the inventory to see if an endpoint has stopped receiving legitimate requests.

  • 04

    Can I use this with any AI client?

    Yes, as long as your client is MCP-compatible, like Claude, Cursor, or Windsurf.

  • 05

    Does the AI see all my traffic?

    No. The AI only sees the inventory data that is explicitly pulled through the Salt Security connection.

  • More questions about Salt Security? See everything the Salt Security Connector can do

Connect Salt Security to Claude, Cursor, ChatGPT & more