Look up any API. See the exact argument to watch.
A precise, per-symbol reference built from the Atropos model pack — the tainted slot, the weakness, how an attacker abuses it, and what to check, for 1,449 symbols across c, javascript, python, typescript.
This reference answers the first for every symbol — then hands you to the engine for the second.
Do not have a symbol? Start with the danger.
The catalog is organized the way you think about risk — by weakness class. Pick one to see every modeled API that reaches it.
Or start with a language.
See which ecosystems the current pack can actually describe.
Read one record end to end.
The observatory answers the first question before a trace begins: what does this symbol do to data?
A write operation reaches a buffer without carrying an inherent proof that the destination is large enough.
Two questions. Two tools.
The reference names the boundary precisely, then hands you to the engine for the codebase-level verdict.
Names the boundary.
- →Which argument is dangerous, and why.
- →The weakness class and its CWE.
- →How it is abused, and what to check.
Judges the flow.
- →Does untrusted data reach that argument?
- →Is a guard already dominating the call?
- →Is this call, in your repo, a real bug?
Atropos names the argument to watch; only a flow through your codebase can decide if it is reachable.