42Crunch Api Security Testing
Automate API security directly in Claude Code with 42Crunch - automatically audit OpenAPI specs, detect vulnerabilities aligned with OWASP API Security risks (including BOLA/BFLA), and apply AI-powered fixes. Designed for AI-assisted development workflows, it provides continuous guardrails through an audit->scan->remediate->validate loop, ensuring APIs meet enterprise security standards before deployment.
Skills (5)
Claude uses these on its own when your request matches.
- 42crunch-api-security-testingRun both a 42Crunch Audit and a live Scan together in a single pipeline. Use this skill when the user wants to run audit and scan together, complete the full security pipeline, or when the request is ambiguous about which phase to run. Triggers on phrases like "run audit and…
- 42crunch-auditRun a 42Crunch API Security Audit and fix SQG-blocking issues in an OpenAPI Specification file. Use this skill whenever the user wants to audit an OAS file for security issues, fix SQG-blocking issues, score an API, apply data dictionary enrichment, or remediate audit findings.…
- 42crunch-scanRun a 42Crunch live conformance and authorization scan against an API and fix SQG-blocking scan findings. Use this skill whenever the user wants to run a conformance test, authorization scan, BOLA test, BFLA test, generate or configure a scan config, or fix scan-reported…
- 42crunch-setupSet up the 42Crunch environment so that audit and scan skills can run without friction. Use this skill whenever the user wants to configure 42Crunch for the first time, install or update the 42c-ast binary, configure an API key, or troubleshoot missing credentials or binary…
- code-to-oasAnalyze an entire API codebase and generate an accurate OpenAPI Specification (OAS 3.0) file from the source code. Use this skill whenever the user wants to generate, create, or derive an OpenAPI spec from code, reverse-engineer an API definition, or document an existing API.…
Install
Run in your terminal
claude plugin install 42crunch-api-security-testing@claude-plugins-officialClaude Code already includes the claude-plugins-official marketplace, so this installs directly. Start a new Claude Code session to use it.
Already in a Claude Code session?
Install
/plugin install 42crunch-api-security-testing@claude-plugins-officialPublished in Anthropic's claude-plugins-official marketplace (anthropics/claude-plugins-official).
Related plugins
- 1SSecurity GuidanceSecurity review for Claude-generated code. Pattern-based warnings on edits, LLM-powered diff review on Stop, and an agentic commit reviewer that catches injection, XSS, SSRF, hardcoded secrets, and 25+ other vulnerability classes.242kmarketplace installs
- 2
SemgrepSemgrep catches security vulnerabilities in real-time and guides Claude to write secure code from the start.20kmarketplace installs
- 3CClaude SecurityDeep vulnerability scanning of your own code, run entirely inside your Claude Code session at a chosen effort tier, with every finding challenged before it is reported and the verification tally computed in code. Turns surviving findings into targeted patches, each verified by a panel of agents, that you apply when you choose.8.6kmarketplace installs
- 4
Sonatype GuideSonatype Guide MCP server for software supply chain intelligence and dependency security. Analyze dependencies for vulnerabilities, get secure version recommendations, and check component quality metrics.7.5kmarketplace installs
- 5
Aikido SecurityAikido Security scanning for Claude Code — SAST, secrets, and IaC vulnerability detection powered by the Aikido MCP server.7.3kmarketplace installs
- 6
SonarqubeAutomatically enforce SonarQube code quality and security in the agent coding loop — 7,000+ rules, secrets scanning, agentic analysis, and quality gates across 40+ languages. PostToolUse hooks run analysis after every file edit. Pre-tool secrets scanning prevents 450+ patterns from reaching the LLM. Slash commands give on-demand access to quality gate status, coverage, duplication, and dependency risks. Includes SonarQube CLI, MCP Server, skills, hooks, and slash commands.6.4kmarketplace installs