Write custom tests with AI
Levo's built-in tests cover the common API attacks. Your application also has risks only you know about: a business rule that must hold, a sequence of calls that must fail, an attack your pentesters found last quarter.
With custom tests, you describe the attack in plain language and your AI assistant writes it as a Levo test. Levo then runs it against your APIs like any other test, with your configured test users and environments, and reports what it finds as vulnerabilities.
Describe the attack for an endpoint. Your assistant writes, validates and saves the test.
Hand your assistant your BChecks or saved Burp requests. It turns each one into a Levo test.
How it works
The test is written by your own AI assistant (Claude, ChatGPT, Cursor, VS Code Copilot, Codex, Gemini CLI and others), connected to Levo through the Levo MCP server.
- The assistant loads Levo's test-writing method and reads the endpoint's details from your API catalog: its parameters, authentication and test users.
- It writes the test and validates it with Levo before saving anything.
- It saves the test to Levo as a custom test plan that waits for your approval.
- You review and approve the test, then run it in Levo.
Nothing runs until you approve it. A test sends real requests to your API, so Levo will not run a custom test until someone has approved its current code. Changing the code withdraws the approval.
Before you start
- Connect the Levo MCP server to your AI assistant. Follow Connect your AI assistant, or open Administration → Levo MCP Server in the Levo app.
- Have the custom test authoring skill enabled for your organization. If the assistant replies that it is not enabled, contact support@levo.ai.
- Have the endpoint in your API catalog, with test users configured for its application if the attack needs an authenticated user. Attacks that act as one user against another user's data need two test users.
Write a new test
Open the endpoint. In the Levo app, click Custom Test on an endpoint's page, on an endpoint's row in an application's Endpoints list, or in an application's header and then choose the endpoint.
Describe the attack. Under What attack do you want to try?, write it the way you would explain it to a colleague. For example: "As one user, try to read or change another user's order by swapping in their order ID." Your description is saved with the test, so whoever approves it knows what it is meant to check.
Choose a category (optional). Leave it as Custom, or pick the attack category the test belongs to, such as BOLA or SQL injection. Levo lists first the categories it has matched to this endpoint.
Copy the prompt and paste it into your assistant. Click Copy Prompt. The prompt carries the endpoint and your description, so you do not need to edit it.
Review the saved test. The assistant validates the test, saves it and gives you a link to it in Levo. It does not approve or run the test unless you tell it to.
Approve and run it. Open the test under Custom tests, check what it does, and approve it. Then run it, from Levo or by asking your assistant, against the environment you choose. Results appear with your other test runs, and failures are reported as vulnerabilities.
You can also start in your assistant, without the Levo app:
- "Write a Levo custom test for
POST /api/ordersthat checks a user can't place an order with a negative quantity." - "Change my custom test Order ownership check to also try the
DELETEmethod." - "Run my approved custom test against staging and tell me the result."
Migrate from Burp Suite
If your team already has security checks in Burp Suite, your assistant can move them to Levo so they run continuously against your APIs instead of only when someone opens Burp.
What you can migrate:
| From Burp | Becomes in Levo |
|---|---|
| Custom scan checks (BChecks) | A test that sends the same requests and fails when the response matches the check's condition. |
| Saved requests from Repeater or Proxy history | A test that replays the request, or the short sequence of requests, through the endpoint's catalog parameters and checks for the secure outcome. |
| Passive checks | A test that sends the endpoint's normal request and checks the response does not show what the check looked for. |
Export your checks from Burp. Save your BCheck files, or select items in Repeater or Proxy history and save them to a file.
Give the file to your assistant. For example: "Migrate the Burp checks in bchecks/ to Levo for the
payments application."
Review the migration report. The assistant matches each check to an endpoint in your Levo catalog, writes one custom test per endpoint, and reports what moved, what did not and why.
Approve and run the new tests, as for any custom test.
Saved Burp requests often contain live tokens, cookies or API keys. The assistant never copies them into a Levo test: Levo tests authenticate as your application's configured test users. If a check needs a second identity, add it as a test user in Levo.
Not migrated today:
- Checks that need an out-of-band callback (a DNS, HTTP or email interaction, as with Burp Collaborator). They are listed in the report as needing a callback service.
- Burp project files, extensions and scan reports. They are not test definitions.
What the assistant can see and change
- It acts as you, with your Levo role. It can read and change only what your account can.
- It saves tests for approval. It approves or runs a test only when you explicitly tell it to, and your client asks you to confirm each of those calls unless you have allowed them automatically.
- Endpoint details and traffic samples it reads are sent to your AI provider. Connect only assistants your company allows for this data. See Data handling and privacy.
Custom tests send real attack traffic to the environment you choose. Run them only against systems you are authorized to test, and check the target before you approve a run.
Troubleshooting
| Problem | What to do |
|---|---|
| The assistant can't reach the Levo MCP server | Connect it: see Connect your AI assistant. |
| The organization doesn't have the custom test authoring skill enabled | Contact support@levo.ai to enable it. |
| Copy Prompt stays disabled | Choose an endpoint, and wait for Levo to load its details. If loading fails, choose Custom as the category to copy the prompt without them. |
| The test can't run | Approve it first. If its code changed after approval, approve it again. |
| A cross-user test can't be written | The application needs two test users. Add a second test user in Levo. |