API Surface Mapper
Paste curl commands or a raw HTTP trace. It maps every request into a tidy surface of methods, hosts, and paths, and pulls tokens, auth headers, and secret query params out of the way first. Nothing is uploaded.
Paste, then run. Findings appear here.
A preview of a Tessera pack
This browser demo runs a handful of checks client-side. The full api pack parses curl and HTTP traces into a validated, secret-redacted API surface map. It is one of 24 job packs in Tessera, an offline toolkit that turns a repository into a single reviewable HTML report.
Every pack follows one contract: normalize, validate, generate artifacts. No services, no API keys, no network calls, nothing executed against your code.
$ pip install tesserakit-api
$ pipx install tesserakit-api # isolated CLI install
$ uv tool install tesserakit-api
$ tessera run --input . --output run
# then open run/index.html