zerodom

active

Point an app at two logged-in users and it finds the broken access control (IDOR). Deterministic browser perception + cross-identity authz testing for AI agents — drives your real Chrome over MCP or runs headless. Open-core, local, no account.

Code-only MCP server: no hosted endpoint, so you install and run it yourself. It is not probed, graded or counted in our reachability statistics.

Get it

Repository: github.com/DevHusnainAi/zerodom
License: Apache-2.0
Last update: 2026-11-14
GitHub stars: ★ 3
Homepage: zerodom.vexralabs.com

ai-agents appsec attack-surface-mapping authorization broken-access-control browser-automation bug-bounty claude cli computer-use dom idor

Listed in

github · source

Run this server as a hosted endpoint? Submit the endpoint and it moves to the remote directory, where it is probed and graded.