Welcome to NAT

NAT (Neuro Agent Testing) is an AI-powered testing platform for API security and functional testing. It autonomously discovers vulnerabilities in your REST and GraphQL APIs, runs browser-based functional tests, catches visual regressions, scans for accessibility violations, and measures Core Web Vitals — all powered by intelligent agents that adapt to your application's behavior in real time.

🧠

New: AI Assistant (nat ai plan, nat ai explain, dashboard chat), compliance badges & reports, nat init zero-config onboarding, live scan progress (--watch), scan comparison (--diff), PR comments, SARIF auto-upload, and more.

Choose your journey

🔍 I want to scan my API→💻 I want to automate testing in CI→🧠 I want AI-guided testing→📋 I need compliance evidence→

What is NAT?

NAT combines multi-agent AI with deep API and browser understanding to deliver testing that is:

  • Autonomous — NAT runs scans end-to-end without manual configuration for each endpoint
  • Intelligent — Adaptive agents prioritize high-risk endpoints and re-test based on new findings
  • Comprehensive — Covers OWASP API Top 10, auth flaws, injection attacks, business logic issues, and more
  • Functional — Visual regression, accessibility scanning, and Core Web Vitals testing with browser-based agents
  • Integrable — Works inside CI/CD pipelines and on-demand via the SaaS REST API

Two onboarding paths

☁️ Path 1 — SaaS API

Sign up, get an API key, and submit an API specification plus its base URL to NAT Cloud.

Sign up for free

Go to app.nat-testing.io/signup (opens in a new tab) — no credit card required.

Get your API key

Open Dashboard → Settings → API Keys and generate a key (nat_pk_...).

Start your first scan

export NAT_API_KEY="nat_pk_your_api_key_here"
 
curl -X POST https://api.nat-testing.io/api/v1/scan \
  -H "X-API-Key: $NAT_API_KEY" \
  -F "spec_file=@openapi.yaml" \
  -F "base_url=https://api.example.com"

→ Full step-by-step guide: API Quickstart

💻 Path 2 — Local CLI / Self-Hosted

Install NAT and run it locally. A NAT Cloud API key is not required for the local CLI path.

Install

pip install nat-engine

Initialize

nat init

Scan

nat scan --spec ./openapi.yaml --base-url https://api.example.com --watch

→ Full step-by-step guide: CLI Quickstart

Want to explore NAT without connecting a real API? Run nat demo after installation for a sandboxed walkthrough.

Quick navigation

🧠 AI Assistant →📋 Compliance →🧪 Functional Testing →🔗 Integrations →Sign Up →API Quickstart →CLI Quickstart →Pricing & Plans →API Reference →FAQ →

What's New

VersionHighlights
v1.6🧠 AI Assistant — nat ai plan, nat ai explain, dashboard chat, proactive insights
v1.5.2📋 Compliance badges, BGSTM audit trail, framework compliance reports
v1.5.1💻 SARIF auto-upload, PR comments, quality gates, nat init zero-config
v1.5🔍 nat scan --watch, nat scan --diff, nat status, nat badge

Changelog →

Key capabilities

CapabilityDescription
AI AssistantAsk NAT anything — test planning, scan interpretation, config advice, compliance reports. CLI (nat ai), dashboard chat, and API.
Compliance & BadgesOWASP, PCI-DSS, HIPAA, SOC 2 compliance reports with embeddable status badges. BGSTM audit trail export.
Zero-Config Onboardingnat init detects your framework and OpenAPI spec and generates a starter .natrc.
Live Scan Progressnat scan --watch shows real-time progress with inline findings. nat scan --diff compares against previous scans.
PR Comments & SARIFAutomatic PR comments with scan summaries and SARIF upload to GitHub Code Scanning via nat-action.
DashboardCloud-hosted control plane for account, API keys, usage, support, and product guidance
REST API TestingFull OWASP API Top 10 coverage with intelligent fuzzing
GraphQL TestingSchema introspection, query injection, auth bypass detection
Functional TestingBrowser-based test execution with DOM snapshots, screenshots, and interaction traces
Visual RegressionPixel-diff analysis against stored baselines with configurable thresholds
Accessibility ScanningWCAG 2.1 compliance checks — missing alt text, form labels, heading order, and more
Performance TestingCore Web Vitals measurement — LCP, FCP, TTI, CLS, TBT with Google threshold grading
Worker PoolsParallel distributed test execution — launch N workers, dispatch jobs via queue, scale horizontally with nat worker launch
Multi-ProtocolgRPC, WebSocket, and Kafka support in addition to REST and GraphQL — see gRPC Scanning Guide
Confidence CalibrationPer-finding confidence scores with calibration tuning to reduce false positives
RBAC & Multi-TenantRole-based access control, SSO (OIDC/SAML), and multi-tenant isolation for enterprise deployments
IntegrationsImport from 7 source formats (OpenAPI, Postman, GraphQL, HAR, Gherkin, cURL, BGSTM) and export findings to 11 trackers (Jira, Linear, GitHub, GitLab, Azure DevOps, Shortcut, PagerDuty, ServiceNow, Webhook, Sentry, Bugzilla)
CI/CD IntegrationNative GitHub Actions support, zero-config pipeline mode, Allure/CTRF export, PR annotations, and quality gates
Demo ModeSafe, risk-free exploration against a built-in target API
Self-HostedDeploy on your own infrastructure — no data leaves your network

How it works

NAT follows the BGSTM 6-phase framework — from AI-driven planning through compliance reporting:

  1. Plan — AI analyzes your OpenAPI spec and prioritizes endpoints by risk (nat ai plan)
  2. Generate — Autonomous agents create intelligent test cases covering OWASP, auth, injection, and business logic (nat ai generate-tests)
  3. Prepare — Configure authentication, environment variables, and execution parameters
  4. Execute — Run tests with live progress, parallel workers, and adaptive retry (nat scan --watch)
  5. Analyze — AI interprets findings with severity ratings, confidence scores, and fix guidance (nat ai explain)
  6. Report — Generate compliance reports, SARIF output, PR comments, and embeddable badges

Need help? See Troubleshooting, the FAQ, or learn about Functional Testing.

Was this helpful?