API Testing Autopilot

## The Problem Every undocumented API gets discovered twice: once by a developer reading route files, again by a tester hand-writing load scripts. On a real codebase — Express routers with middleware mounts, Go services with nested route groups and `const`-concatenated paths — that manual pass takes 15–20 minutes and produces errors. The `/{id}` suffix on nested Go product routes is easy to miss. QA repeats the entire process to write k6 scripts. The result: duplicated effort, inconsistent coverage, and load tests that hit the wrong URLs. ## The Solution **API Testing Autopilot** is an MCP server for IBM Bob 2.0 that collapses both passes into one call: scan source → generate k6 → run → return numbers. Bob invokes it from natural language: *"Scan my project at ./my-api."* Three properties are non-negotiable: 1. **Pure AST parsing.** No LLM guesses a URL. Every endpoint is extracted from the syntax tree — Express `router.get`, Go 1.22 pattern strings, Flask `@app.route`, FastAPI `APIRouter`. All four parsers run as WASM in Node — no Go or Python toolchain required. 2. **Human-like load tests.** Generated k6 scripts use `ramping-vus` (ramp up → hold → ramp down), random endpoint selection per iteration, and variable per-VU think time (0.5–2.5 s). Traffic looks like real visitors, not a synchronized herd. 3. **Safe by default.** A host whitelist is enforced in code before any packet leaves the machine. Remote hosts with API keys are supported via config. The 20% error-rate abort protects the target during runs.