42crunch-api-security-testing Claude Code Plugin
Claude Code PluginClaude CodeSecuritySecurity, Auth & ComplianceCode Quality, Review & TestingWeb & App DevelopmentThe explanation below is AI-generated. Please verify it against the sources.
This plugin adds automated API security testing to Claude Code by connecting to the 42Crunch platform. According to the README, it performs static audits of OpenAPI specification files, runs live conformance and authorization scans (including BOLA/BFLA checks) against a running API, and can generate an OpenAPI specification from existing source code. Findings are scored and grouped by severity, and any AI-assisted fix is applied only after the user explicitly agrees. The overall workflow is built around a cycle of auditing, scanning, remediating, and re-validating so that an API meets a defined security bar before it ships.
About the service
42Crunch is a platform focused on API and MCP server security. Based on its homepage material, it offers contract-based static and dynamic testing, scoring, and checks aligned with OWASP API Security risks and authorization flaws such as BOLA/BFLA, available through freemium or paid accounts. This plugin talks to that platform using an API key or freemium token to run its audit and scan operations.
What you can do with 42crunch-api-security-testing
- Configure 42Crunch credentials and install the required 42c-ast binary
- Run a static audit of an OpenAPI spec file and get a scored security report
- Execute a combined audit-then-scan pipeline in one session
- Generate an openapi. json file by analyzing existing API source code