AI Explorer · Tier 1 endpoint hypothesis

What it is

Tier 1 is the first stage of the three-tier Deep Audit AI Explorer. It runs after JupiterSec finishes recon and the Triager judges the static findings. Its job is to propose which endpoints + vulnerability classes are worth probing with the heavier Tier 2 scenarios.

Tier 1 reads:

• JupiterSec’s clustered endpoint model (URLs, methods, params, auth requirements)
• The Triager’s confirmed findings (so it doesn’t repeat work)
• The list of in-scope authentication credentials (labels only: plaintext never appears in prompts)

It produces a ranked list of candidate (endpoint, vuln_class) pairs. Each candidate has a hypothesis (“this /api/orders/{id} endpoint accepts an integer ID and lacks an org check, likely IDOR”) and a confidence score.

What it produces

Up to ~40 candidates per scan. Each carries:

• kind: one of the supported vuln classes (idor, oauth_redirect, jwt_confusion, mass_assignment, etc.)
• url + method
• evidence: Tier 1’s reasoning
• confidence: 0-1 score used to prioritise Tier 2 dispatch

Why it matters

A naive open-ended LLM hunt on a 200-endpoint app burns budget fast and produces noise. Tier 1 narrows the search to the 30-40 most-promising probe targets, before Tier 2’s scenario playbooks (which are expensive: they probe live) ever run.

How it fits with Tier 2 and Tier 3

Tier	Role	Model
Tier 1 (this)	Hypothesis generation over the recon inventory	Sonnet
Tier 2	Scripted scenario playbooks per candidate	Sonnet
Tier 3	Open-ended hunt on the full recon bundle	Opus