Pynt tests APIs for exploitable security flaws, aimed at the developers and testers who build them rather than only at a security team. It shows what an attacker could actually abuse in an organisation’s APIs, with evidence and fix guidance, instead of a long list of theoretical issues.
That matters more as AI features spread, because LLMs, agents and the MCP ecosystem all run on APIs, and every new integration adds endpoints that few people have reviewed.
At A Glance
| Vendor | Pynt |
|---|---|
| Category | Application security, dynamic API security testing |
| Deployment | CLI, Docker container, testing tool integrations, CI/CD, web dashboard |
| Agentic AI | LLM Security Testing, LLM Discovery and MCP Runtime |
| Certifications | SOC 2 Type II |
| Funding | Seed, led by Joule Ventures |
| Market classification | Application Security; also Cloud Security |
What Pynt Does
API flaws are hard to catch late. Business logic bugs and data exposure rarely show up in a scanner, and security teams cannot review every endpoint by hand. Pynt’s aim is to let developers and testers handle API security themselves, early in the lifecycle and inside the tools they already use. Its testing is driven by how the application really behaves, following real user journeys rather than random fuzzing, and each issue is proven before it is reported, so developers spend their time on flaws that can actually be exploited.
Products
API Security Testing
API Security Testing is for teams that want to know which API flaws are exploitable, not just theoretically present. It tests APIs and web apps with an understanding of context and of how calls chain together, finds business logic flaws and sensitive or excessive data exposure, and checks Postman collections against the OWASP API Top 10.
API Discovery
Many organisations do not know how many APIs they run. API Discovery builds a catalogue from live traffic covering documented, undocumented, shadow and newly added APIs, gives each endpoint a risk score automatically and can generate a penetration test report from the catalogue.
LLM And MCP Security
As teams wire LLMs into their products, LLM Discovery finds the LLM APIs buried in code and LLM Security Testing checks those models against the OWASP LLM Top 10. MCP servers expose tools to AI agents through APIs, which makes them a new attack surface; MCP Runtime is an agent-based firewall that lets an organisation control which MCP use is allowed, or switch it off entirely.
How It Works
| Component | What it does |
|---|---|
| CLI | Pynt runs from a lightweight command line tool. Command mode runs scans on demand, while listen mode watches API traffic in real time. Results come out as JSON for pipelines and tooling. |
| Container | A Docker image is available, including a standalone mode that runs without the CLI for isolated testing at scale. |
| Inside testing tools | Testers can launch Pynt from the Postman desktop app, through Newman on local collections, inside Burp Suite or straight from the browser. |
| Discovery sources | The API Catalog is built from API documentation such as Swagger and Postman collections, from API gateways, from live traffic captured with eBPF or traffic mirroring, and from code repositories. |
| Dashboard | A web dashboard organises applications, the API Catalog and scan history. |
Integrations
| Area | Integrations |
|---|---|
| API testing tools | Postman, Newman, Burp Suite, Selenium, Rest Assured, Insomnia, ReadyAPI |
| CI/CD | GitHub Actions, GitLab, Jenkins, Azure DevOps |
| API gateways | AWS, Azure, Kong, GCP, Gravitee |
| Other | Jira, Kubernetes |
Company Background
| Headquarters | Israel, with an American headquarters in Wilmington, Delaware |
|---|---|
| Leadership | Tzvika Shneider (Co-Founder and CEO), Ori Goldberg (CTO), Golan Yosef (CSO), Ofer Hakimi (CPO) |
| Funding | A reported $6 million seed round in September 2023, led by Joule Ventures with Dallas VC and Honeystone VC |
Note: This overview is compiled from Pynt’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.