api-critic

An automated checker for REST APIs, which are web endpoints that applications use to exchange data. It tests normal and unusual requests for correctness, security, speed, error handling, and standards compliance.

In plain words
What is it for?
Use it to inspect a live or local API, test listed routes or discovered endpoints, run quick or extended checks, and compare results with an earlier test.
Why use it?
It helps reveal broken responses, weak authentication, unsafe input handling, and other backend problems before users or attackers find them.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/jansenanalytics/claudex/api-critic
Any agent
npx skills add JansenAnalytics/claudex --skill api-critic
Clone the repo
git clone --depth 1 https://github.com/JansenAnalytics/claudex

Made for: Claude Code, Codex.

Per session 72 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 842 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 1 finding. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00072 $0.00842
Opus 5 $0.00036 $0.00421
Sonnet 5 $0.00014 $0.00168
Haiku 4.5 $0.00007 $0.00084

Measured 2d ago against content hash e0722872e41f, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

api-critic scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

The scan reads SKILL.md. This mod also ships 4 executable files (scripts/discover.cjs, scripts/probe.cjs, scripts/report.cjs, …), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Runs shell commandslowCapability

Expected in a hook, worth knowing in a rule or an instructions file.

None. Uses only Node.js built-in modules (http, https, fs, path, url, child_process).
skills/api-critic/SKILL.md · 99 lines

How it starts

The opening of the file, as written. The whole thing — 99 lines — stays where its author put it; the contents beside it link to each section on GitHub.

api-critic — Autonomous API Testing & Evaluation

Like design-critic but for backends. Tests any REST API for correctness, security, performance, error handling, and standards compliance.

Quick Start

api-critic https://jsonplaceholder.typicode.com
api-critic http://localhost:3000 --auth "Bearer token" --full
api-critic http://localhost:3000 --quick
api-critic http://localhost:3000 --compare /tmp/api-critic-previous

Options

Flag Description
--endpoints FILE Manual route list (JSON: [{method, path, body?}])
--auth "Bearer x" Authorization header for all requests
--timeout MS Request timeout (default: 10000)
--quick Skip edge cases (SQL injection, XSS, oversized payload)
--full Run everything including extended probes
--compare DIR Compare with previous run's output directory
--out-dir DIR Output directory (default: /tmp/api-critic-TIMESTAMP)

What It Tests

Correctness

  • Happy path (valid requests → 2xx)
  • JSON validity, schema types
  • Status code correctness (201 for POST, 204 for DELETE)

Security

  • CORS wildcard detection
  • Auth bypass (requests without auth header)
  • Malformed token acceptance
  • SQL injection strings in query params
  • XSS reflection in responses
  • Mass assignment (extra unknown fields accepted)

Performance

  • Response time (>500ms warning, >2000ms critical)

Error Handling

  • Empty body, null values → should get 4xx not 5xx
  • Wrong Content-Type handling
  • Oversized payload (1MB)

Standards

  • Content-Type headers present
  • Cache headers on GET responses
  • 405 for wrong HTTP methods
  • Pagination support detection

Pipeline

  1. discover.cjs — Finds endpoints (OpenAPI spec, common paths, CRUD inference)
  2. probe.cjs — Runs all tests against each endpoint
  3. report.cjs — Generates scored report (0-100, grade A-F)

Output

  • discovered-endpoints.json — Found endpoints
  • probe-results.json — Raw test results
  • api-critic-report.md — Human-readable report
  • api-critic-report.json — Machine-readable summary

Read the full file on GitHub · 99 lines

Files

What ships with it

4 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 99 lines · 72 tokens per session scan A e0722872e41f

Subscribe to this mod's changes

api-critic is a skill published in the GitHub repository JansenAnalytics/claudex (5 stars, last pushed 2mo ago), licensed MIT. It adds 72 tokens to every session and 842 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 1 finding (runs shell commands). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

Other skills, from other repositories

API Test Suite Generator

Automatically generate comprehensive API test suites from OpenAPI specifications covering CRUD operations, error handling, authentication, pagination, and edge cases.

PramodDutta/qaskills · 29 tokens

sql-database-support

Guides classifying, gap-analyzing, and scaffolding support for a new SQL database in pREST (wire-compatible variants like TimescaleDB or new dialects). Use when adding database support, creating integration/ /, DIFFERENCES.md, adapters/ , per-DB docker-compose or GitHub workflows, or planning where config/app wiring…

prest/prest · 79 tokens

noodle-use

Teach agents to create, organize, maintain, evaluate, import, convert, and automate noodle terminal REST client collections using supported CLI commands plus YAML and dotenv files.

wilfredinni/noodle · 36 tokens

forgetful-cli-setup

Set up the Forgetful CLI and connect from a terminal — install, local or remote mode, auth, and verification. Use when connecting a human or headless agent via shell, wiring CI with token auth, or operating a local server (serve, database selection, feature flags, re-embedding). Also covers the machine contract…

ScottRBK/forgetful · 84 tokens

ocli-api

Turn any OpenAPI/Swagger API into CLI commands and call them. Search endpoints with BM25, check parameters, execute — no MCP server needed.

EvilFreelancer/openapi-to-cli · 34 tokens

ast-introspection

Use Go AST-aware analysis to enumerate symbols, extract signatures, and propose mechanically safe refactors (read-only by default).

pilinux/gorest · 28 tokens