What the agent does
The agent combines router prefixes with the application's settings before listing endpoints. In fastapi/full-stack-fastapi-template, backend/app/main.py:35 includes api_router with settings.API_V1_STR, and backend/app/core/config.py:22 sets its default to /api/v1. backend/app/api/main.py:7-14 includes login, users, utilities and items, then includes the private router only when FASTAPI_ENV is development. The inventory records that condition explicitly. A route observed in development is not automatically part of a differently configured deployment.
Authentication requires following dependencies, including aliases. backend/app/api/deps.py:49 defines CurrentUser through Depends(get_current_user), and lines 52-57 add the superuser privilege check. routes/items.py:15 uses CurrentUser in the list handler, while routes/users.py:32-37 attaches Depends(get_current_active_superuser) in the decorator. The agent follows both forms. It also reads the ownership conditions inside item handlers, where a valid login alone does not authorize access to someone else's item.
The parameter inventory links signatures to the SQLModel request and response classes in backend/app/models.py. It distinguishes UUID path values, pagination query parameters, JSON bodies and form data: routes/login.py:25 uses OAuth2PasswordRequestForm rather than a JSON credential object. It compares the resulting table with the application's OpenAPI document, configured at settings.API_V1_STR plus /openapi.json in main.py:23. Schema output helps verify parameters, but inline ownership checks still require reading the handler.
The agent checks backend/pyproject.toml, the dependency lock and backend/README.md before preparing the server. The README's local path starts PostgreSQL and Mailpit, then runs uv sync, uv run bash scripts/prestart.sh and uv run fastapi dev. It uses fresh sandbox database settings and test mail delivery, never a production connection string. Anonymous probes retain the original status and any redirect rather than following it into an apparent success. Local-only mutations need disposable records; blocked startup or missing permissions produce clearly unverified rows.
Start it with one API call
POST https://api.prix.dev/o/{org}/sessions with this body:
{
"agent": "claude",
"input": "Write endpoints.md for the attached FastAPI repository. Enumerate composed router paths and environment-conditional routes, trace Depends and Annotated aliases to authentication and privilege checks, and read request models plus inline ownership conditions. List method/path, handler file:line, path/query/body/form parameters and expected access. Compare source with OpenAPI. Prepare only a disposable local backend, database and test mail sink using documented commands, then probe every safely exercisable route without credentials and record status, response type and redirects. Separate intentional public routes from successful protected operations; label unverified checks. Do not call production, edit app source, push or open a PR.",
"resources": [
{
"url": "https://github.com/your-org/your-app"
}
]
}- Get an API key. In the console, open Settings, then API keys, and create a key for your org. Send it in the Authorization header as a Bearer token.
- Send the request. POST the body in request.json to https://api.prix.dev/o/{org}/sessions, with your repository as the resources URL. The run starts in its own cloud sandbox.
- Read what came back. Follow the run on its live stream or wait for the run.completed webhook, then read the result and its trajectory.
What comes back
endpoints.md groups the API by router and includes the final URL, handler location, model references, authentication dependency, privilege requirement and observed anonymous response. A dedicated section describes environment-specific exposure and differences between OpenAPI and source. Another section lists operations that could not be exercised, with the exact setup failure or side-effect concern. Public sign-up and token issuance remain distinct from authenticated account reads and superuser administration.
The reviewer checks that dependency aliases were expanded, that local environment flags match the table and that a validation error was not mistaken for successful access. A missing UUID or malformed form can stop a request before it reaches the behavior under review. The report preserves request shape and coverage limitations so another developer can repeat the check. Rush returns the answer and file artifacts through the session; the task requests documentation, not a code change or an invented security certification.
Run it on every backend schema change
Have your CI or webhook receiver submit a session when routers, dependencies or API models change. Name the intended environment in the input and use the candidate branch's GitHub tree URL as the repository resource. An Idempotency-Key lets a retry return the same session instead of launching duplicate local inventories.
Your service can wait for the configured completion webhook, then read the session's artifacts. Compare access requirements and body formats as well as added paths. For example, moving a check from a handler argument to a router-wide dependency should preserve the relevant inventory rows even though their source reference changes.
The use case this job follows, with its automation and trigger: Produce a report or file, no repo.
Why run it on Rush?
FastAPI's dependency system makes a clean handler signature possible while hiding important access rules behind aliases. Rush gives the agent its own place to follow those imports, inspect generated schema and prepare a local backend with separate database and mail settings. Your laptop's existing development stack does not become the target of anonymous mutation probes.
The session record ties a reported response to the command that requested it and the configuration that started the server. That is more useful in review than a table generated from decorators alone. You can submit inventories for different services within your concurrency allowance and receive separate reports, including honest startup failures rather than assumed HTTP results.
Frequently asked questions
Why inspect code when FastAPI already exposes OpenAPI?
OpenAPI is useful for paths, schemas and declared security. Resource ownership and conditional behavior can live inside ordinary Python functions. The agent cross-checks schema against those functions instead of treating either source as complete by itself.
Will the inventory include development-only routes?
It includes them with their registration condition and whether they were active during the local check. In the example, the private router depends on FASTAPI_ENV. The report avoids presenting that development surface as an unconditional deployment route.
Does a validation error prove an endpoint requires login?
No, a malformed request may fail for reasons unrelated to authentication. The agent reads the dependency chain and uses valid local parameter shapes where safe. Static intent and observed behavior remain separate columns when one probe cannot settle the question.
Can it safely test password recovery?
Only against sandbox-owned accounts with a local test mail sink and no external recipients. Recovery endpoints can send mail even without a login. If that isolation cannot be established, the report lists the route and leaves its runtime check unverified.