42crunch-api-security-testing — Claude Code plugin: setup & guide
This plugin audits OpenAPI specs for OWASP vulnerabilities, runs live conformance scans to catch BOLA or BFLA flaws, and helps apply contract fixes directly in Claude Code.
/plugin install 42crunch-api-security-testing@claude-plugins-official
/plugin marketplace add anthropics/claude-plugins-officialWhat 42crunch-api-security-testing does
The plugin brings automated API security checks into Claude Code sessions. It bundles five commands: /generate-oas creates openapi.json from application source code or Postman and Insomnia files, /42crunch-audit scores specification files from 0 to 100, and /42crunch-scan executes live fuzzing against an active backend. The full workflow can also run via /42crunch-api-security-testing.
Initial setup runs through /42crunch-setup. The command downloads the 42c-ast binary and writes credentials to ~/.42crunch/conf/env with 600 permissions. For live testing, the target API must be up and reachable at the URL defined in the contract or inside SCAN42C_HOST.
You need an active 42Crunch account to run audits. The assistant never modifies files silently: every code and specification patch requires explicit confirmation before application.
What it helps with
- audit OpenAPI specification files against OWASP security standards
- test running API endpoints for BOLA and BFLA authorization flaws
- create an openapi.json file from source code, Postman, or Insomnia collections
- patch API schemas and backend code with AI assistance
Example prompts for the agent
- /42crunch-audit
- /42crunch-scan
- /generate-oas
How to install 42crunch-api-security-testing
Plugin marketplace
/plugin install 42crunch-api-security-testing@claude-plugins-official/plugin marketplace add anthropics/claude-plugins-officialStep by step, with commands for each platform: Claude Code plugins: marketplaces, installing, and building your own
Questions about 42crunch-api-security-testing
How to install 42crunch-api-security-testing in Claude Code?
Run /plugin marketplace add anthropics/claude-plugins-official to register the marketplace, then execute /plugin install 42crunch-api-security-testing@claude-plugins-official.
What does 42crunch-api-security-testing do?
It inspects OpenAPI contracts for security weaknesses, runs automated scans against active servers to detect authorization defects, and applies fixes with user approval.
What are the prerequisites for running 42crunch-scan?
You need a valid 42Crunch account and a reachable API server running at the address specified in the OAS file or the SCAN42C_HOST environment variable.
