API Relay Audit
A local security audit tool for AI API relays and LLM proxies that checks for prompt injection, model substitution, tool-call rewriting, response-stream anomalies and credential-related risk.
API Relay Audit is a standalone Python script that runs a local security audit against a third-party AI API relay, mirror, gateway or LLM proxy, informed by published research on malicious relays that inject payloads and exfiltrate credentials. It checks observable relay behavior for prompt and context signals such as hidden prompt injection and context truncation, response integrity issues such as changed pinned package-command text, error-response leakage and SSE stream anomalies, and generates a markdown report with per-step evidence and low, medium or high severity summaries.
It uses only Python's standard library plus curl, sends the user's API key only to the chosen relay URL, and includes a separate profile for checking Web3 wallet related risk. The tool does not certify that a relay is safe and does not replace manual security review.