# 42crunch-api-security-testing

This plugin audits OpenAPI specs for OWASP vulnerabilities, runs live conformance scans to catch BOLA or BFLA flaws, and helps apply contract fixes directly in Claude Code.

- plugin · `type=plugin` · Claude Code · ★ 1
- Author: 42Crunch
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/42Crunch-AI/claude-plugins/tree/HEAD/plugins/api-security-testing
- Updated: 2026-09-28
- HTML: https://affpapa.org/en/nevibecode/plugins/42crunch-api-security-testing

## What it does

The plugin brings automated API security checks into Claude Code sessions. It bundles five commands: `/generate-oas` creates `openapi.json` from application source code or Postman and Insomnia files, `/42crunch-audit` scores specification files from 0 to 100, and `/42crunch-scan` executes live fuzzing against an active backend. The full workflow can also run via `/42crunch-api-security-testing`.

Initial setup runs through `/42crunch-setup`. The command downloads the `42c-ast` binary and writes credentials to `~/.42crunch/conf/env` with `600` permissions. For live testing, the target API must be up and reachable at the URL defined in the contract or inside `SCAN42C_HOST`.

You need an active 42Crunch account to run audits. The assistant never modifies files silently: every code and specification patch requires explicit confirmation before application.

## Install

### Claude Code (native platform)

**Plugin marketplace**
In the agent chat (not a shell):
```text
/plugin install 42crunch-api-security-testing@claude-plugins-official
```
In the agent chat (not a shell):
```text
/plugin marketplace add anthropics/claude-plugins-official
```

## When to use it
- audit OpenAPI specification files against OWASP security standards
- test running API endpoints for BOLA and BFLA authorization flaws
- create an openapi.json file from source code, Postman, or Insomnia collections
- patch API schemas and backend code with AI assistance

## Example prompts
- /42crunch-audit
- /42crunch-scan
- /generate-oas

## Similar
- [security-guidance](https://affpapa.org/en/nevibecode/plugins/security-guidance.md) — plugin · ★ 44770
- [mcp-tunnels](https://affpapa.org/en/nevibecode/plugins/mcp-tunnels.md) — plugin · ★ 44770
- [hookify](https://affpapa.org/en/nevibecode/plugins/hookify.md) — plugin · ★ 44770
- [code-modernization](https://affpapa.org/en/nevibecode/plugins/code-modernization.md) — plugin · ★ 44770
- [claude-security](https://affpapa.org/en/nevibecode/plugins/claude-security.md) — plugin · ★ 44770
- [google-cloud-developer](https://affpapa.org/en/nevibecode/plugins/google-cloud-developer.md) — plugin · ★ 21606

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md