> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/web-application-and-api-protection-waap/discovery/risk/conformance-analysis.md). # Conformance Analysis Traceable's **Conformance Analysis** helps you identify deviations between the APIs and MCP assets defined in your documentation and those observed by Traceable based on live traffic. This enables you to identify undocumented or unused endpoints and MCP assets, as well as discrepancies between documented and observed behavior. Traceable provides two options for performing conformance analysis: **One-Time** and **Scheduled**. ## **Asset categories** Conformance analysis classifies API endpoints and MCP assets based on their presence in the uploaded documentation and the traffic observed by Traceable. The following categories are used during conformance analysis: ### Shadow assets/endpoints These are APIs or MCP assets that Traceable identifies from live traffic but that are not defined in the uploaded documentation. * For **API documentation**, shadow endpoints are those Traceable identifies through traffic analysis, but these endpoints were not part of the specification you uploaded. For example, if the uploaded API specification contains `GET /cart` and `GET /checkout`, but Traceable also identifies `GET /admin` as an API endpoint, then `GET /admin` is classified as a shadow endpoint.

In Traceable, GET /cart and POST /cart are two different API endpoints.

* For **MCP Server** **documentation**, shadow assets are MCP assets that Traceable identifies from live traffic but that are not defined in the uploaded MCP Server documentation. Shadow assets can include MCP servers, tools, resources, and prompts. ### Orphan assets/endpoints These are APIs or MCP assets defined in the uploaded documentation but not observed by Traceable during the analysis. * For **API documentation**, orphan endpoints are the endpoints that are part of the API specification uploaded by the user; however, Traceable has either not observed or is still learning these API endpoints. For example, if the API specification contains `GET /cart` and `GET /checkout`, but Traceable does not observe `GET /checkout` during analysis, then `GET /checkout` is classified as an orphan endpoint. * For **MCP Server documentation**, orphan assets are MCP assets defined in the uploaded documentation but not observed by Traceable in live traffic during analysis. Orphan assets can include MCP servers, tools, resources, and prompts. ### Matched endpoints with issues These are the endpoints in the API specification you uploaded, and Traceable has also observed them. However, Traceable has observed some discrepancies, including type mismatches, missing parameters, and authentication issues. An example of type mismatch occurs when you define a parameter as an integer, whereas Traceable interprets it as a string. {% hint style="info" %} This category is applicable only to **API documentation**. {% endhint %} ### Matched endpoints without issues These are the endpoints in the API specification you uploaded. Traceable has also observed these endpoints but did not observe any discrepancies in parameters, such as type mismatch, missing parameters, or shadow parameters. {% hint style="info" %} This category is applicable only to **API documentation**. {% endhint %} *** ## Setting Up Conformance Analysis {% tabs %} {% tab title="One-Time Analysis" %} The one-time conformance analysis is designed to execute a comprehensive evaluation once, according to the parameters you specify while starting the analysis. However, you can manually re-run the conformance analysis according to your requirements. To start a conformance analysis, navigate to **Discovery** → **Conformance Analysis** **→ One Time** and click **Start Analysis**. A pop-up window is shown containing the following sections:
Manual Conformance Analysis

Manual Conformance Analysis

* **Documentation Type** — The type of documentation that you wish to upload or choose from, for example, *MCP Server*.

The availability of some of the following configurations depend on the documentation type you select.

* **Documentation ID** — The Conformance Analysis is done against the API specification or MCP Server manifest you choose from this drop-down list. You can either select one or all entries available in the drop-down list or upload the documentation below. The list is populated either from the **Click to upload** section or from **Discovery → Settings → Documentation**. * **Click to Upload** — The API specifications or MCP Server manifests you upload here are added to the **Documentation ID** drop-down list. You can upload a maximum of 10 API specifications, with a total size not exceeding *20 MB*.\ Traceable supports the following file types based on the **Documentation Type**: | Documentation Type | Supported file types | | ------------------ | -------------------- | | Open API Spec | .yaml, .yml, .json | | WSDL | .wsdl | | MCP Server | .yaml, .yml | For information on the MCP server manifest format, see [Sample MCP server manifest format](/web-application-and-api-protection-waap/discovery/discovery-1/documentation-and-inspector.md#sample-mcp-server-manifest-format).

You can select an entry from the drop-down and upload a new API specification or MCP Server manifest at the same time. For example, if there are five entries available in the drop-down list, you can select all five or fewer, and also add a new API specification or MCP Server manifest using the Click to Upload section.

* **Job name** — Specify the name of the analysis job. * **Environment** — Select an environment from the drop-down list against which you want to run the conformance analysis. * **Select API Endpoints/MCP Servers** — Select the assets (API endpoints or MCP servers) against which you wish to run the analysis. You can run the analysis against: * All Endpoints/MCP Servers * Specific Endpoints/MCP Servers * Endpoint/MCP Server Selection Condition * **Drift Scope** — The API elements you wish to run the analysis on, such as Path, Query, Request Cookie, and Request Header. You can select from the available options in the drop-down according to your requirements.
* Click **Submit** to start the analysis.

The analysis job result is stored for 10 days, after which they are automatically deleted.

The scheduled analysis is designed to conduct a comprehensive evaluation at regular intervals, ensuring consistent analysis. Traceable provides two options for performing scheduled conformance analysis: Manual and System-Generated. ### Manual Analysis The configuration of a manual analysis is similar to that of a one-time analysis; however, you can set it to run at specific intervals according to your requirements. To do so, navigate to **Discovery** → **Conformance Analysis** → **Scheduled** and click on **Start Analysis**. A slide-out panel is displayed containing the options described in the following sections. * **Documentation Type** — The type of documentation that you wish to upload or choose from, for example, *MCP Server*.

The availability of some of the following configurations depend on the documentation type you select.

* **Documentation ID** — The Conformance Analysis is done against the API specification or MCP Server manifest you choose from this drop-down list. You can either select one or all entries available in the drop-down list or upload the documentation below. The list is populated either from the **Click to upload** section or from **Discovery → Settings → Documentation**. * **Click to Upload** — The API specifications or MCP Server manifests you upload here are added to the **Documentation ID** drop-down list. You can upload a maximum of 10 API specifications, with a total size not exceeding *20 MB*.\ Traceable supports the following file types based on the **Documentation Type**: | Documentation Type | Supported file types | | ------------------ | -------------------- | | Open API Spec | .yaml, .yml, .json | | WSDL | .wsdl | | MCP Server | .yaml, .yml | For the sample manifest of an MCP server, which you should upload, see Sample MCP manifest.

You can select an entry from the drop-down and upload a new API specification or MCP Server manifest at the same time. For example, if there are five entries available in the drop-down list, you can select all five or fewer, and also add a new API specification or MCP Server manifest using the Click to Upload section.

* **Job name** — Specify the name of the analysis job. * **Environment** — Select an environment from the drop-down list against which you want to run the conformance analysis. * **Select API Endpoints/MCP Servers** — Select the assets (API endpoints or MCP servers) against which you wish to run the analysis. You can run the analysis against: * All Endpoints/MCP Servers * Specific Endpoints/MCP Servers * Endpoint/MCP Server Selection Condition * **Schedule** — Select the schedule according to which Traceable should run the analysis, for example, *Daily 8:30 AM*. * **Drift Scope** — The API elements you wish to run the analysis on, such as Path, Query, Request Cookie, and Request Header. You can select from the available options in the drop-down according to your requirements.
* Click **Submit** to start the analysis.

The analysis job result is stored for 10 days, after which they are automatically deleted.

### System-generated analysis The system-generated analysis is an automated analysis that runs independently every 12 hours from the last automated job run. The automated job runs for API documentation that is enabled for naming. For example, if 12 API documentations are available, out of which 8 are enabled for naming, then the automated conformance analysis job runs for 8 API documentations. {% hint style="info" %} * **System Generated Analysis** is available for *Open API Spec* documentation types only. * Traceable executes the system-generated analysis on the *Path*, *Query*, *Request Cookie*, and *Request Header* parameters. {% endhint %} To enable API documentation for naming, navigate to **Discovery** → **Settings** → **Documentation**, edit an existing API specification, and select the **Enabled for Naming** toggle, as shown below. You can also use the **Documentation** tab to upload a new API specification or delete existing documentation. Any API specification uploaded from the **Documentation** tab is visible in the **Documentation ID** drop-down list, as displayed in the One-time and Manual analysis sections. In one-time and manual analysis, you can choose the environment in which you want to run the conformance analysis. In contrast, the system-generated conformance analysis job runs for all the environments. The results of the system-generated conformance analysis are available in the **Discovery** → **Conformance Analysis** → **Scheduled** → **System Generated** tab. These results are available for 3 days. To view results for the analysis of specific environments, select the **Environment** from the drop-down list in the top right corner. {% endtab %} {% tab title="Scheduled Analysis" %} The one-time conformance analysis is designed to execute a comprehensive evaluation once, according to the parameters you specify while starting the analysis. However, you can manually re-run the conformance analysis according to your requirements. To start a conformance analysis, navigate to **Discovery** → **Conformance Analysis** **→ One Time** and click **Start Analysis**. A pop-up window is shown containing the following sections:
Manual Conformance Analysis

Manual Conformance Analysis

* **Documentation Type** — The type of documentation that you wish to upload or choose from, for example, *MCP Server*.

The availability of some of the following configurations depend on the documentation type you select.

* **Documentation ID** — The Conformance Analysis is done against the API specification or MCP Server manifest you choose from this drop-down list. You can either select one or all entries available in the drop-down list or upload the documentation below. The list is populated either from the **Click to upload** section or from **Discovery → Settings → Documentation**. * **Click to Upload** — The API specifications or MCP Server manifests you upload here are added to the **Documentation ID** drop-down list. You can upload a maximum of 10 API specifications, with a total size not exceeding *20 MB*.\ Traceable supports the following file types based on the **Documentation Type**: | Documentation Type | Supported file types | | ------------------ | -------------------- | | Open API Spec | .yaml, .yml, .json | | WSDL | .wsdl | | MCP Server | .yaml, .yml | For information on the MCP server manifest format, see [Sample MCP server manifest format](/web-application-and-api-protection-waap/discovery/discovery-1/documentation-and-inspector.md#sample-mcp-server-manifest-format).

You can select an entry from the drop-down and upload a new API specification or MCP Server manifest at the same time. For example, if there are five entries available in the drop-down list, you can select all five or fewer, and also add a new API specification or MCP Server manifest using the Click to Upload section.

* **Job name** — Specify the name of the analysis job. * **Environment** — Select an environment from the drop-down list against which you want to run the conformance analysis. * **Select API Endpoints/MCP Servers** — Select the assets (API endpoints or MCP servers) against which you wish to run the analysis. You can run the analysis against: * All Endpoints/MCP Servers * Specific Endpoints/MCP Servers * Endpoint/MCP Server Selection Condition * **Drift Scope** — The API elements you wish to run the analysis on, such as Path, Query, Request Cookie, and Request Header. You can select from the available options in the drop-down according to your requirements.
* Click **Submit** to start the analysis.

The analysis job result is stored for 10 days, after which they are automatically deleted.

The scheduled analysis is designed to conduct a comprehensive evaluation at regular intervals, ensuring consistent analysis. Traceable provides two options for performing scheduled conformance analysis: Manual and System-Generated. ### Manual Analysis The configuration of a manual analysis is similar to that of a one-time analysis; however, you can set it to run at specific intervals according to your requirements. To do so, navigate to **Discovery** → **Conformance Analysis** → **Scheduled** and click on **Start Analysis**. A slide-out panel is displayed containing the options described in the following sections. * **Documentation Type** — The type of documentation that you wish to upload or choose from, for example, *MCP Server*.

The availability of some of the following configurations depend on the documentation type you select.

* **Documentation ID** — The Conformance Analysis is done against the API specification or MCP Server manifest you choose from this drop-down list. You can either select one or all entries available in the drop-down list or upload the documentation below. The list is populated either from the **Click to upload** section or from **Discovery → Settings → Documentation**. * **Click to Upload** — The API specifications or MCP Server manifests you upload here are added to the **Documentation ID** drop-down list. You can upload a maximum of 10 API specifications, with a total size not exceeding *20 MB*.\ Traceable supports the following file types based on the **Documentation Type**: | Documentation Type | Supported file types | | ------------------ | -------------------- | | Open API Spec | .yaml, .yml, .json | | WSDL | .wsdl | | MCP Server | .yaml, .yml | For the sample manifest of an MCP server, which you should upload, see Sample MCP manifest.

You can select an entry from the drop-down and upload a new API specification or MCP Server manifest at the same time. For example, if there are five entries available in the drop-down list, you can select all five or fewer, and also add a new API specification or MCP Server manifest using the Click to Upload section.

* **Job name** — Specify the name of the analysis job. * **Environment** — Select an environment from the drop-down list against which you want to run the conformance analysis. * **Select API Endpoints/MCP Servers** — Select the assets (API endpoints or MCP servers) against which you wish to run the analysis. You can run the analysis against: * All Endpoints/MCP Servers * Specific Endpoints/MCP Servers * Endpoint/MCP Server Selection Condition * **Schedule** — Select the schedule according to which Traceable should run the analysis, for example, *Daily 8:30 AM*. * **Drift Scope** — The API elements you wish to run the analysis on, such as Path, Query, Request Cookie, and Request Header. You can select from the available options in the drop-down according to your requirements.
* Click **Submit** to start the analysis.

The analysis job result is stored for 10 days, after which they are automatically deleted.

### System-generated analysis The system-generated analysis is an automated analysis that runs independently every 12 hours from the last automated job run. The automated job runs for API documentation that is enabled for naming. For example, if 12 API documentations are available, out of which 8 are enabled for naming, then the automated conformance analysis job runs for 8 API documentations. {% hint style="info" %} * **System Generated Analysis** is available for *Open API Spec* documentation types only. * Traceable executes the system-generated analysis on the *Path*, *Query*, *Request Cookie*, and *Request Header* parameters. {% endhint %} To enable API documentation for naming, navigate to **Discovery** → **Settings** → **Documentation**, edit an existing API specification, and select the **Enabled for Naming** toggle, as shown below. You can also use the **Documentation** tab to upload a new API specification or delete existing documentation. Any API specification uploaded from the **Documentation** tab is visible in the **Documentation ID** drop-down list, as displayed in the One-time and Manual analysis sections. In one-time and manual analysis, you can choose the environment in which you want to run the conformance analysis. In contrast, the system-generated conformance analysis job runs for all the environments. The results of the system-generated conformance analysis are available in the **Discovery** → **Conformance Analysis** → **Scheduled** → **System Generated** tab. These results are available for 3 days. To view results for the analysis of specific environments, select the **Environment** from the drop-down list in the top right corner. {% endtab %} {% endtabs %} *** ## Analysis report Once you start the conformance analysis, Traceable runs the job according to your configured settings. After the analysis is complete, click the job to view the analysis results. The conformance analysis report provides a summary of the analysis, the scope used, and details of the APIs or MCP assets identified by Traceable. The information displayed in the report depends on the **Documentation Type** you selected when configuring the analysis. The following tabs highlight these details according to your requirements. {% tabs %} {% tab title="API Endpoint analysis" %} When you perform a conformance analysis using **Open API Spec** or **WSDL**, the analysis report provides information about the API endpoints defined in the documentation and the API endpoints observed by Traceable.
Scheduled Manual Conformance Analysis

API Endpoint Analysis Report

#### Summary The **Summary** section provides an overview of the API endpoints identified in the uploaded documentation and observed by Traceable. The **API Endpoints** section displays the following: * **Spec** — The number of API endpoints defined in the uploaded API documentation. * **Traceable** — The number of API endpoints observed by Traceable through live traffic. #### Scope The **Scope** section summarizes the configuration used for the conformance analysis, including: * **Environment** — The environment against which the analysis was performed. * **API Documentation** — The API documentation used for the analysis. * **API Endpoints** — The API endpoints included in the analysis. * **Drift Scope** — The API elements included in the drift analysis. #### Details of API The **Details of API** section categorizes the API endpoints identified during the analysis and displays the number of endpoints in each category. The section includes: * **Matched Endpoints with Issues** * **Shadow** **Endpoints** * **Orphan** **Endpoints** * **Matched Endpoints without Issues** Click an endpoint category to view the corresponding endpoints in the right pane. The endpoint list provides details such as **API Endpoint**, **Service**, **Sensitivity**, **Risk**, and **Last Seen**. Further, you can click on endpoint to view detailed information about it. When you perform a conformance analysis using **MCP Server**, the analysis report provides information about the MCP assets defined in the MCP Server manifest and the assets observed by Traceable through live traffic.
MCP Server Analysis Report

MCP Server Analysis Report

#### Summary The **Summary** section provides an overview of the MCP assets identified in the MCP Server manifest and observed by Traceable through live traffic. The **Assets** section is divided into **Documentation** and **Live Traffic**: * **Documentation** — Displays the number of MCP assets defined in the MCP Server manifest. * **Live Traffic** — Displays the number of MCP assets observed by Traceable through live traffic. The assets are categorized as: * **MCP Servers** * **MCP Tools** * **MCP Resources** * **MCP Prompts** For example, in the screenshot above, the documentation contains *1 server*, *5 tools*, *0 resources*, and *0 prompts*, while Traceable has observed *3 servers*, *9 tools*, *3 resources*, and *4 prompts* through live traffic. #### Scope The **Scope** section summarizes the configuration used for the conformance analysis. It includes: * **Environment** — The environment against which the analysis was performed. * **Documents** — The MCP Server manifest used for the analysis. * **MCP Servers** — The MCP servers included in the analysis. For example, in the above screenshot, the job was run against **all MCP servers** in the **Fintech-app** environment using the **two\_tools\_spec.yaml** MCP Server manifest. #### Details of MCP Server The **Details of MCP Server** section categorizes the MCP assets identified during the analysis. The section includes: * **Shadow Assets** * **Orphan Assets** Click an asset category to view the corresponding assets in the right pane. The asset list provides details such as **Asset Name**, **Asset Type**, **Server Name**, **Host Name**, **Risk**, and **Last Called**. Further, you can click an asset to view its detailed information. {% endtab %} {% tab title="MCP Server analysis" %} When you perform a conformance analysis using **Open API Spec** or **WSDL**, the analysis report provides information about the API endpoints defined in the documentation and the API endpoints observed by Traceable.
Scheduled Manual Conformance Analysis

API Endpoint Analysis Report

#### Summary The **Summary** section provides an overview of the API endpoints identified in the uploaded documentation and observed by Traceable. The **API Endpoints** section displays the following: * **Spec** — The number of API endpoints defined in the uploaded API documentation. * **Traceable** — The number of API endpoints observed by Traceable through live traffic. #### Scope The **Scope** section summarizes the configuration used for the conformance analysis, including: * **Environment** — The environment against which the analysis was performed. * **API Documentation** — The API documentation used for the analysis. * **API Endpoints** — The API endpoints included in the analysis. * **Drift Scope** — The API elements included in the drift analysis. #### Details of API The **Details of API** section categorizes the API endpoints identified during the analysis and displays the number of endpoints in each category. The section includes: * **Matched Endpoints with Issues** * **Shadow** **Endpoints** * **Orphan** **Endpoints** * **Matched Endpoints without Issues** Click an endpoint category to view the corresponding endpoints in the right pane. The endpoint list provides details such as **API Endpoint**, **Service**, **Sensitivity**, **Risk**, and **Last Seen**. Further, you can click on endpoint to view detailed information about it. When you perform a conformance analysis using **MCP Server**, the analysis report provides information about the MCP assets defined in the MCP Server manifest and the assets observed by Traceable through live traffic.
MCP Server Analysis Report

MCP Server Analysis Report

#### Summary The **Summary** section provides an overview of the MCP assets identified in the MCP Server manifest and observed by Traceable through live traffic. The **Assets** section is divided into **Documentation** and **Live Traffic**: * **Documentation** — Displays the number of MCP assets defined in the MCP Server manifest. * **Live Traffic** — Displays the number of MCP assets observed by Traceable through live traffic. The assets are categorized as: * **MCP Servers** * **MCP Tools** * **MCP Resources** * **MCP Prompts** For example, in the screenshot above, the documentation contains *1 server*, *5 tools*, *0 resources*, and *0 prompts*, while Traceable has observed *3 servers*, *9 tools*, *3 resources*, and *4 prompts* through live traffic. #### Scope The **Scope** section summarizes the configuration used for the conformance analysis. It includes: * **Environment** — The environment against which the analysis was performed. * **Documents** — The MCP Server manifest used for the analysis. * **MCP Servers** — The MCP servers included in the analysis. For example, in the above screenshot, the job was run against **all MCP servers** in the **Fintech-app** environment using the **two\_tools\_spec.yaml** MCP Server manifest. #### Details of MCP Server The **Details of MCP Server** section categorizes the MCP assets identified during the analysis. The section includes: * **Shadow Assets** * **Orphan Assets** Click an asset category to view the corresponding assets in the right pane. The asset list provides details such as **Asset Name**, **Asset Type**, **Server Name**, **Host Name**, **Risk**, and **Last Called**. Further, you can click an asset to view its detailed information. {% endtab %} {% endtabs %} *** ### Create tickets From the analysis result page, you can create tickets for identified issues directly from the corresponding rows. Traceable supports integrations with **Jira**, **ServiceNow ITSM**, and **Azure DevOps**. To create a ticket, click the **Integration** icon in the corresponding column for an API endpoint or MCP asset. You can create tickets for: * **API endpoints** — **Shadow Endpoints** and **Matched Endpoints with Issues**. * **MCP assets** — **Shadow Assets** and **Orphan Assets**, where supported. When creating a ticket, Traceable provides a **Link to job** that takes you to the corresponding conformance analysis job. The link is available for all supported ticketing integrations. {% hint style="info" %} The **Link to job** option is valid only for 10 days since the result generation time. {% endhint %} *** ## Viewing Detected Issues Traceable highlights security gaps (issues) identified through conformance analysis directly on the **Issues** page. The Issues page offers a detailed view of each issue. This enables you to view the issues directly in a centralized dashboard and take the necessary actions for remediation. To view the issues raised via conformance analysis, navigate to **Discovery** → **Risk** → **Issues,** and in the page’s top right corner, click the **Filter** icon and select either of the following: * **Source**: Conformance Analysis * **Category**: Select the applicable category based on the issue type: * *API Governance* for API endpoint issues. * *MCP Tools*, *MCP Resources*, or *MCP Prompts* for MCP asset issues. This detailed issues view ensures that you can identify, track, and resolve the conformance-related security gaps within your application ecosystem. For more information, see [Issues Overview](/web-application-and-api-protection-waap/discovery/risk/issues-overview.md) and [Issue Management](/web-application-and-api-protection-waap/discovery/risk/issue-management.md).