apisec-inc

apisec-inc/mcp-audit

MCP server Claude CodeCodexCursor +2

MCP server "filesystem" as configured in apisec-inc/mcp-audit. Runs locally from the @anthropic/mcp-server-filesystem npm package.

apisec-inc/mcp-audit

MCP server Claude CodeCodexCursor +2

Lets the agent read channels and post messages in a Slack workspace. Runs locally from the @modelcontextprotocol/server-slack npm package. Needs 1 environment variable to run.

apisec-inc/mcp-audit

MCP server Claude CodeCodexCursor +2

MCP server "custom-tool" as configured in apisec-inc/mcp-audit. Launched with ./local/my-mcp-server.py.

apisec-inc/AI-Surface

MCP server Claude CodeCodexCursor +2

MCP server "github-mcp", hosted remotely at mcp.github.com, as configured in apisec-inc/AI-Surface.

apisec-inc/AI-Surface

MCP server Claude CodeCodexCursor +2

MCP server "stripe-mcp" as configured in apisec-inc/AI-Surface. Runs locally from the @stripe/mcp-server npm package.

apisec-inc/apisec-skills

Cursor rule

Requires explicit role assertion before executing admin-scoped operations. Prevents privilege escalation and BFLA vulnerabilities.

apisec-inc/apisec-skills

Cursor rule

Enforces authentication middleware on all API route handlers. Applies to Express, FastAPI, Django, Spring, Go Gin.

apisec-inc/apisec-skills

Cursor rule

Prevents leaking internal error details, stack traces, or database error messages in API responses.

apisec-inc/apisec-skills

Cursor rule

Requires validation of all user-supplied input before use. Prevents injection, unexpected types, and missing required fields.

apisec-inc/apisec-skills

Cursor rule

Requires ownership validation on any endpoint that accesses database records by user-supplied ID. Prevents BOLA/IDOR vulnerabilities.

apisec-inc/apisec-skills

Skill Claude CodeCodex

Use when developer explicitly asks to review an endpoint, controller, service, or API for security issues. Also triggers on: "review this for security", "is this secure", "check this endpoint", "security audit", "what are the vulnerabilities here", or when asked to review a full route file or controller file. This is…

apisec-inc/apisec-skills

Skill Claude CodeCodex

Use when developer is implementing authentication, building login/logout flows, writing JWT validation, adding middleware, creating role-based access control, building permission systems, or asking how to protect routes. Also triggers on keywords: auth, bearer token, JWT, session, middleware, permissions, roles…

apisec-inc/apisec-skills

Skill Claude CodeCodex

Use when writing or reviewing any API endpoint that retrieves, updates, or deletes a record by user-supplied ID. Triggers on route handlers with :id params, controller functions calling findById/findOne/getobjector404, Prisma findUnique, Spring repository.findById, or any ORM lookup by identifier. Does NOT trigger on…

apisec-inc/apisec-skills

Skill Claude CodeCodex

Use when writing database queries, file system operations, shell commands, XML/HTML processing, template rendering, or any operation that incorporates user-supplied input into a command or query. Triggers on: SQL queries, MongoDB queries, Mongoose queries, file path construction, exec/spawn/system calls, template…

apisec-inc/apisec-skills

Skill Claude CodeCodex

Use when developer is writing, reviewing, or editing an OpenAPI spec (swagger.yaml, openapi.yaml, openapi.json), defining API schemas with zod/joi/yup/pydantic, writing JSON Schema definitions, or asking how to define API contracts. Also triggers on: "define this schema", "add validation", "write the OpenAPI spec"…

apisec-inc/apisec-skills

Skill Claude CodeCodex

Use when developer is writing tests, asked to add test coverage, writing Jest/Mocha/pytest/JUnit test files, or when reviewing an endpoint that has only happy-path tests. Also triggers when developer says "write tests for this", "add test coverage", or "what should I test here". Generates security-focused test cases…