---
title: ToolRouter — Agent Use Case Guide
description: Step-by-step guide for completing a task with a specific AI agent using ToolRouter.
url: https://toolrouter.com/tools/pentest/use-cases/test-api-security/copilot
---
# How to Test API Security with Copilot

Copilot integrates penetration testing directly into your development workflow, letting you scan for vulnerabilities and generate fix code without leaving your IDE. Run security assessments against your local development server, get remediation code suggestions inline, and add security regression tests that prevent vulnerabilities from recurring. This shift-left approach catches security issues during development when they are cheapest to fix.

## Setup

{"mcpServers":{"toolrouter":{"command":"npx","args":["-y","toolrouter-mcp"]}}}

## Steps

1. Add ToolRouter to Copilot MCP config
2. In Copilot Chat: "Test the security of my API" and provide the base URL
3. Copilot runs security tests and returns findings
4. Ask: "Generate middleware to fix these API security issues"
5. Apply the fixes directly in your codebase

## Example Prompt

```
Test the security of my Express API running at http://localhost:3001. Check for injection, auth bypass, and missing security headers.
```

## Tips

- Copilot can generate security middleware code directly in your IDE
- Test your API during development rather than waiting for a security review
- Ask Copilot to add API security tests to your test suite
