An agent that tests REST APIs at the system level. REST APIs are web endpoints that applications call to exchange data, and system-level testing checks their real behaviour rather than just individual functions.

Use it when backend changes are ready for testing. It designs and runs API test cases, including checks for idempotency, multitenancy, and performance smoke tests, then records the results and bugs.

It provides structured checks for endpoint results, status codes, repeated requests, tenant separation, and basic performance. It helps find backend behaviour problems without asking the test agent to fix them.

api-tester — Agent for coding agents by volodchenkov: An agent that tests REST APIs at the system…

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods

npx agentmods add agents/volodchenkov/claude-sdlc-agents/api-tester

Clone the repo

git clone --depth 1 https://github.com/volodchenkov/claude-sdlc-agents

Or install sdlc-agents, the plugin that ships this one along with the rest of its 12 skills, 13 agents.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/agents/volodchenkov/claude-sdlc-agents/api-tester.svg)](https://agentmods.dev/agents/volodchenkov/claude-sdlc-agents/api-tester)

Your own site

<a href="https://agentmods.dev/agents/volodchenkov/claude-sdlc-agents/api-tester"><img src="https://agentmods.dev/badge/agents/volodchenkov/claude-sdlc-agents/api-tester.svg" alt="Measured on agentmods" height="20"></a>

Per session 57 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.

When invoked 3,546 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 1 finding. Scan, not verified.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5	$0.00057	$0.03546
Opus 5	$0.00028	$0.01773
Sonnet 5	$0.00011	$0.00709
Haiku 4.5	$0.00006	$0.00355

Measured 4d ago against content hash 9a5049e2503d, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

api-tester scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

- Test approach (level, types, tools — pytest+requests / curl / Postman / etc.)

agents/api-tester.md · 267 lines

How it starts

The opening of the file, as written. The whole thing — 267 lines — stays where its author put it; the contents beside it link to each section on GitHub.

API Tester

Role declaration (consumed by `agent-base` skill)

role_label:      "API Tester"
role_slug:       "api-tester"
kb_extra:
  - "$KB_DIR/kb/stack.md"        # backend stack to know what you're testing
  - "$KB_DIR/kb/verify.md"       # spin up local API, staging URL, auth setup
  - "$KB_DIR/kb/multitenancy.md" # critical for negative TCs (cross-tenant isolation)
skills_extra:
  - "istqb-test-design"
artifact_label:  "artifact:api-testing"
sub_issue_title: "API Tests: <root_name> (<PROJECT_IDENTIFIER>-<N>)"

At session start, run the agent-base checklist (greeting, project context, common STOPs, mention discipline). Continue with role-specific work below.

Identity

I am the team's API Tester. I follow ISTQB Foundation Level (CTFL syllabus v4.0) for test design discipline. I produce test plans, execute REST API test cases against the project's backend, file bug reports, and produce final test reports.

I do NOT test UI (that's the ui-tester). I do NOT review code or architecture (that's reviewer / architect). I do NOT fix bugs.

Short-pipeline early exit

If the root issue carries the label pipeline:doc-only (plane-api.md §6.13b), this task is a documentation update — not your job. Run redirect_task to the relevant coder (the one whose code area the docs cover), mention initiator, STOP. No greeting, no further reads.

Role-specific STOPs (in addition to agent-base §4)

No Backend sub-issue (artifact:backend) found on root, or it has no CHANGES comment yet — backend coder hasn't shipped. ask_blocking_question, mention initiator, STOP.
No SPEC sub-issue or no SPEC_APPROVED marker — can't validate API contract without baseline.
No REQUIREMENTS in root description — can't trace TCs to FR/NFR.
Backend service / staging not reachable — can't execute tests. Comment with details, mention initiator, STOP.

Input / Output

Read (via read_artifact):

Root issue description = REQUIREMENTS (FR/NFR/Acceptance Criteria)
SPEC sub-issue description (especially §3 API Contract, §5 Quality Attributes)
Backend sub-issue CHANGES comment (what was actually implemented — for "as-built" vs SPEC trace)
Real codebase to understand actual endpoint paths / auth setup

Read the full file on GitHub · 267 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

4d ago First seen · 267 lines · 57 tokens per session scan A 9a5049e2503d

Subscribe to this mod's changes

api-tester is an agent published in the GitHub repository volodchenkov/claude-sdlc-agents (2 stars, last pushed 1mo ago), licensed MIT. It adds 57 tokens to every session and 3,546 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Backend and APIs E2E testing Testing

e2e-verifier

FlutterアプリのE2E動作検証エージェント。MCP（dart-mcp + Marionette）を使い、シミュレーター上でUI操作・検証を行う。mobile-automationスキルから呼び出される。.

K9i-0/ccpocket · 65 tokens

chaos-engine-implementer

Implement one bounded specification before consolidated validation.

ShaftHQ/SHAFT_ENGINE · 15 tokens

ask-smoke

Run a live smoke test of the /ask endpoint (SSE-streamed RAG). Boots fireseqsearchserver via tests/runlogseq.sh, runs tests/testask.py (protocol/invariant assertions) and tests/testendpoints.py --ask against a user-supplied question, and reports on answer grounding, citation validity, source quality, streaming…

Endle/fireSeqSearch · 100 tokens

qa-reviewer

QA code reviewer who validates Playwright E2E test implementations against project rules and patterns. Runs tests, reviews test architecture, and works interactively with the engineer. Never modifies code.

platformplatform/PlatformPlatform · 41 tokens

electron-e2e-test-runner

Use this agent when you need to run, debug, or troubleshoot end-to-end Electron tests. This includes handling test execution, interpreting test results, and resolving common Electron testing issues like process launch failures, test timeouts, or environment setup problems. Examples:\n\n \nContext: The user is working…

sahithvibudhi/vibe-tree · 365 tokens

visual-tester

Visual QA tester — navigates web UIs via Chrome CDP, spots visual issues, tests interactions, produces structured reports.

HazAT/pi-interactive-subagents · 28 tokens

api-tester