Cerberus symbolCERBERUS AI

    Solutions / Shadow and zombie API discovery

    You can't defend what you can't see.

    Undocumented, deprecated, and forgotten endpoints are where breaches start. Cerberus discovers every API and agent on your surface from real traffic, not a stale spec.

    All solutions
    API inventory3 unmanaged
    GET/api/v1/usersdocumented
    POST/internal/debugshadow
    GET/api/v0/legacyzombie
    MCP/tools/fs.readshadow
    verdictinventoryrisk-rankmonitor

    Illustrative product interface. The figures shown are an example of how Cerberus presents a detection, not benchmark or performance results.

    Drift from spec

    What ships rarely matches the OpenAPI doc it was supposed to follow.

    Deprecated, still live

    Old versions stay reachable for years after they leave the docs.

    Agents add surface

    Every new MCP server and tool is fresh, unmonitored attack surface.

    How it works

    An inventory built from traffic.

    Specs go stale the day they are written. Real traffic does not.

    01
    Discovered from real requests
    Cerberus builds a live inventory of every endpoint, version, and agent actually in use, not what a document claims.
    02
    Classified and risk-ranked
    Each route is tagged documented, shadow, or zombie and scored by exposure and sensitive-data flow.
    03
    Watched from day one
    Newly discovered surface is monitored immediately, with the same detection as the rest of your API.

    Coverage

    What Cerberus catches here.

    Shadow APIs

    Live endpoints that never made it into any documentation.

    Zombie endpoints

    Deprecated versions still reachable and still exploitable.

    Undocumented MCP servers

    Agent tool endpoints stood up outside any review.

    Untracked agents

    Autonomous actors operating without an owner or a policy.

    Spec drift

    Routes and parameters that diverge from the published contract.

    Sensitive data exposure

    Forgotten endpoints quietly returning PII or secrets.

    FAQ

    Common questions

    What is a shadow API?

    A shadow API is a live endpoint that never made it into your documentation or inventory. It usually ships as a debug route, an internal helper, or a quick integration, then stays reachable in production. Because nothing tracks it, it gets no review, no monitoring, and no patching, which makes it a favorite entry point for attackers.

    What is a zombie API?

    A zombie API is a deprecated endpoint that is still reachable after its replacement shipped. The docs say v3, but the traffic says v0 still answers. Old versions miss the security fixes and validation the current version gets, so they stay exploitable for years unless something is watching for them.

    How does Cerberus discover endpoints without a spec?

    Cerberus builds the inventory from real traffic. Because the instrumentation runs inside your application, every request that reaches your code is observed, including routes no spec mentions. Each discovered endpoint is classified as documented, shadow, or zombie, risk-ranked by exposure and sensitive-data flow, and monitored from the moment it first appears.

    Does discovery cover AI agents and MCP servers?

    Yes. Agents and MCP tool endpoints are discovered the same way, from the traffic they actually generate. New tool servers and autonomous actors show up in the inventory alongside your APIs, each with an owner, a history, and the same detection pipeline watching them from day one.

    See the whole surface.

    See Cerberus read your own traffic, human and agentic, in one walkthrough tailored to your stack.

    All solutions