Right now, we support checking if the app uses minimal permissions to call APIs by using information from API Center. This is great for production scenarios, where information about APIs is centralized in APIC. For for more ad-hoc usage, we should support the same capability without depending on APIC. We'd introduce a new plugin which users configure with a path to a local folder where they store API specs.