Comparing Test Types
Understand the differences between CodeWall's test types and when to use each.
CodeWall supports several test types optimized for different targets and objectives.
Test type comparison
| Feature | Web Application | Web API | MCP Server Security | LLM App / Chatbot |
|---|---|---|---|---|
| Target | Browser-accessible sites | REST/GraphQL endpoints | MCP tool servers | LLM chat/completion APIs |
| Reconnaissance | Crawling, form discovery, sitemap parsing | Endpoint enumeration, schema analysis | Tool enumeration, schema analysis | Endpoint probing, format detection |
| Authentication testing | Login flows, session management, MFA bypass | API keys, OAuth, JWT validation | Tool-level auth probing | N/A |
| Injection testing | XSS, SQLi, command injection via forms | SQLi, NoSQLi, command injection via params | SQLi, command injection, path traversal, SSRF via tool params | Prompt injection (direct and indirect) |
| Access control | Privilege escalation, IDOR via UI | BOLA/IDOR, broken function-level auth | Unauthorized tool access | System prompt extraction, data exfiltration |
| Best for | Customer-facing apps, internal portals | Microservices, mobile backends | AI tool integrations, agent pipelines | Chatbots, AI assistants, LLM wrappers |
When to use each
Web Application
Use when your target has a browser interface with login pages, forms, and navigation. CodeWall will crawl the application like a user would, testing every interaction point.
Web API
Use when your target exposes API endpoints directly. Provide an OpenAPI/Swagger spec if available — this dramatically improves coverage. Ideal for headless services and microservice architectures.
MCP Server Security
Use when your target exposes tools via the Model Context Protocol. CodeWall will enumerate all tools, analyse their input schemas, and test each parameter for injection and access control issues.
LLM App / Chatbot
Use when your target is an LLM-powered application. CodeWall will test for prompt injection, system prompt extraction, data exfiltration from context and RAG sources, and guardrail bypass techniques.
Combining test types
For comprehensive coverage, consider running multiple test types:
- A Web Application test against your frontend
- A Web API test against the same application's backend API
- An MCP Server Security test against any tool-serving endpoints
- An LLM App / Chatbot test against AI-powered features
This provides layered coverage across your entire stack.