For AI-assisted backend development
AI can add backend routes across files faster than you can inspect them. APIScout gives you a local, source-backed inventory before those changes ship.
router.get("/accounts",
requireAuth, handler);
src/routes/accounts.ts:18
The problem
A pull request can look reasonable while it introduces a route, method, or handler that nobody explicitly reviewed. Reading diffs alone is a poor way to understand the API your application now exposes.
Built for Cursor, Claude Code, GitHub Copilot, and Windsurf users who need to understand the implementation before they trust the documentation.
Why this happens
Agents work from a task description, not an inventory of your API contract. Asked to let users edit projects, one adds router.delete("/:id") beside the update handler because the pattern looks incomplete. requireAuth proves the caller is authenticated — not that they own the record.
A feature router is mounted below /v1/organizations/:organizationId. The handler declares a relative path; the reachable one is assembled elsewhere. A diff answers what text changed, not what is now callable.
Generated tests cover the requested feature's happy path. They rarely assert that no unrequested route became reachable, so a passing suite is not evidence that exposure was intended.
How APIScout solves it
APIScout runs inside VS Code and reads the backend source tree locally. It turns route discovery into an inspectable inventory, then exports OpenAPI when the API needs to move into documentation, testing, or security workflows.
Open the backend project in VS Code.
Scan the source tree to see discovered routes, methods, and modules.
Review the exposed surface before merge, then export OpenAPI when you need it.
Benefits by role
Treat the API surface as a review artifact. Inspect paths and methods after an agent finishes, then jump from an endpoint to the source that defines it.
Give reviewers a shared answer to “what did this change expose?” without asking them to reconstruct the routing graph from a diff.
New endpoints enter threat modeling and test scope while the branch is still open, rather than after they become production behavior.
In practice
Review the endpoint list, not only the diff, on agent-authored backend changes.
A two-line diff can still move the API surface.
Require an owner and an authorization expectation for each new route.
Authentication middleware is not an authorization decision.
Compare the OpenAPI baseline before and after a release-sized change.
Don't wait for a hand-maintained spec to catch up after merge.
FAQ
It focuses on API visibility: routes, methods, source context, and OpenAPI export. It complements code review by making the resulting HTTP surface inspectable.
Use it when a change can add or alter routing, authentication boundaries, or request handlers — most usefully before a feature branch merges.
No. APIScout scans the project locally in VS Code, and the optional AI runs against local models.
When APIScout is not enough
APIScout shows which routes exist; it cannot prove authorization is enforced correctly at runtime. Use security testing when a changed endpoint needs validation against real identities.
How ApyGuard extends the workflow
When an AI-assisted change creates a new API surface, export the OpenAPI baseline and use ApyGuard for automated security testing before release.
APIScout for VS Code
Install the free, local-first extension to discover backend endpoints, inspect their source context, and export an OpenAPI baseline when the workflow needs one.
Install APIScout — Free