API Security Scan

Find the security holes in your API design before they ship. Read-only: it flags issues with file:line, it doesn't change your code.

Prerequisites

• None. Pure Claude Code — reads your OpenAPI/Swagger spec or route/handler code directly, no MCP required.

Trigger

• "Security review my API / OpenAPI spec"
• "Check my endpoints for missing auth"
• "API security scan"

Workflow

1. Locate the API surface: an OpenAPI/Swagger file if present, otherwise the route definitions and handlers.
2. Review each endpoint against the checks below; report path or file:line, severity, and the fix.