Add API Relay Audit

[toby-bridges]

Adds API Relay Audit to the Red Teaming & Vulnerability Scanners section. It is a local 14-step audit tool for AI API relays and LLM proxies, covering prompt injection, model substitution, tool-call rewriting, error leakage, SSE anomalies, and Web3 wallet-risk probes.

[secxena]

Thanks for the submission. Looking at the traction signals we rely on for listing decisions, the repo shows 672 stars but 0 watchers, with starring beginning within hours of repo creation at a steady, uniform rate over months. That pattern makes it hard for us to assess organic adoption, so we are passing for now. If the project builds verifiable community usage (real user issues and discussions, watchers, downstream adoption), we can revisit.

[toby-bridges]

Thanks for taking the time to review this.

I respect that this is a curated list and that you may choose to wait for more adoption evidence. I do want to clarify the watcher/subscriber point, because GitHub’s terminology is easy to misread here.

In GitHub’s REST API, watchers_count currently mirrors stargazers_count; the notification-watch number is subscribers_count. If you mean notification subscribers, then yes, that number is currently 0. But I do not think that is a strong proxy for usage or project fit, especially for a local CLI audit tool. Users can run API Relay Audit locally, download the standalone script, fork it, or star it without subscribing to all repository notifications.

The project’s intended scope is narrow: local auditing for third-party AI API relays and LLM proxies used in agent and coding-agent workflows. It checks relay-layer prompt injection, model identity drift, tool-call rewriting, error leakage, SSE anomalies, and Web3 wallet probes.

There are also public signals beyond stars: forks, externally opened issues/PRs, active maintenance, release artifacts, documentation, and reproducible local audit outputs.

If the concern is scope fit, I am happy to adjust the entry or withdraw the PR. If the concern is mainly an adoption threshold, I would appreciate clarification on what threshold you would like to see before revisiting.

Disclosure: I maintain API Relay Audit.