Perfai Security is a security tool focused on access control testing for AI-coded applications, with the core goal of discovering "broken access control" issues in applications. Officially, it is positioned as "access control testing for AI applications," emphasizing that AI-built applications often get permission settings wrong, and one incorrect permission can lead to customer data or admin functionality being exposed.
In terms of main capabilities, Perfai covers more than 90 categories for testing permission issues in applications. The official scale example given is: the average application contains 80 UIs, 200 APIs, 100 objects, and 6 roles, which combine to about 2,280 permissions. Perfai tests these thousands of permissions to find the broken or risky ones. Internally, it is completed through the collaboration of three types of agents: the Vision agent, the Security agent, and the Fix agent. According to the official description, the three are respectively responsible for "mapping every permission," "exploiting that permission," and "delivering verified fixes," forming a closed loop from permission mapping to verified remediation.
In terms of usage, the official three-step process is given: first, paste the application URL; second, have Perfai learn and test; third, discover permission issues. This process shows that it uses the application URL as the entry point, automatically learns the application structure and performs permission testing, and ultimately presents the discovered permission issues.
In terms of applicable scenarios, Perfai is suitable for teams and developers who need to conduct access control security testing on applications generated by AI coding, especially those with many UIs, APIs, objects, and role combinations, complex permission matrices, and a tendency to make mistakes in permission configuration. It can also be used before launch or during a security assessment to quickly obtain a check result at the access control level.
Regarding cost and limitations, the official information explicitly provides free access control reports, marked with "Free plan · No credit card," but details such as the specific functional scope of the free plan, the upper limit on the number of permissions, and whether automatic fixes are included are not yet provided. Other details such as supported platforms, integration methods, testing frequency, and report export formats are also not yet provided.