Map Your APIs from Source Inside Claude Code and Codex
The APIScout plugin brings ApyGuard's source code API discovery into your coding agent. Ask it to scan a backend project, and it returns the API inventory, findings tied to their exact source location, and an OpenAPI document you can export or compare.
The engine runs on your machine, and the agent can fix approved findings and verify them with a rescan, or hand the project to an ApyGuard security scan.
From Source Code to Verified API Findings
APIScout's source code discovery, available from a conversation in the coding agent your team already uses.
Map the API surface
Scan local backend source code and get a summary of the API it exposes, straight from the code that serves it.
Findings with source evidence
Each finding comes with endpoint evidence and its exact source location, so your team can check it instead of trusting it.
Explain any endpoint
Ask about a route and the agent answers from the code that handles it, not from guesses.
Fix and verify
Approve a finding, let the agent fix it in source, and confirm the fix with a rescan.
Export and compare OpenAPI
Export the project's OpenAPI document as JSON or YAML, and compare two documents to see what changed.
From static review to live scan
Take a project into an ApyGuard live scan and map its findings back to the source that caused them.
How It Works
Five steps from installing the plugin to findings you can act on.
Install the plugin
Add the ApyGuard marketplace and install the plugin with two commands in Claude Code or Codex.
Sign in to ApyGuard
The first time you use a tool, the agent gives you an ApyGuard sign-in link and a code to approve in your browser.
Ask your agent to scan
The APIScout engine scans the project on your machine and returns the API inventory and findings.
Review the evidence
Open the APIScout Workbench, explain endpoints from source, and filter findings by severity or category.
Fix, export, or scan live
Fix approved findings, export OpenAPI, or create an ApyGuard asset and start a live security scan there.
Install in Two Commands
Run them in a terminal, then restart the client so it loads the plugin.
Claude Code
$ claude plugin marketplace add ApyGuard/APIScout-Plugin$ claude plugin install apyguard-apiscout-plugin@apyguard-apiscout
Codex
$ codex plugin marketplace add ApyGuard/APIScout-Plugin$ codex plugin add apyguard-apiscout-plugin@apyguard-apiscout
Then ask your agent
- >Scan this project with APIScout and summarize the API findings.
- >Open the APIScout Workbench for this project.
- >Show high-sensitivity API findings in this project.
- >Export this project's OpenAPI document to openapi.json.
Requirements
- Claude Code or Codex, in the terminal or the desktop app
- uv, which also fetches the Python 3.13 runtime the plugin needs
- macOS, Linux x86-64 with glibc 2.28 or newer, or Windows through WSL
- An ApyGuard account for the browser sign-in
Where Your Data Goes
Scans run on your machine. Here is what leaves it, and when.
On your machine
The MCP server and the APIScout engine run locally. Scans, exports, and comparisons read and write local files and do not upload them.
To your AI provider
Tool results, including source excerpts for the endpoints you ask about, become part of your Claude Code or Codex conversation under your provider's terms. The plugin does not call an AI provider itself.
To ApyGuard
Signing in sends the client type and a random installation id. The generated OpenAPI document reaches ApyGuard only when you create an asset or import documentation.
Read the plugin privacy policy for the details.
Frequently Asked Questions
Does APIScout upload my source code?
No. Scans run on your machine and do not upload source files. Tool results, including source excerpts for the endpoints you ask about, become part of your Claude Code or Codex conversation and reach that client's model provider. ApyGuard receives the generated OpenAPI document only when you create an asset or import documentation.
Do I need an ApyGuard account?
Yes. The plugin asks you to sign in to ApyGuard in the browser before its scan, findings, endpoint, export, and comparison tools run.
Which platforms are supported?
macOS on Apple silicon and Intel, Linux x86-64 with glibc 2.28 or newer, and Windows through WSL. Linux arm64 and native Windows are not supported yet.
How is it different from APIScout for VS Code?
APIScout for VS Code shows the API inventory inside the editor. The plugin brings APIScout into Claude Code and Codex, so your agent can scan a project, explain endpoints, fix findings, and export OpenAPI from a conversation.
Is the plugin open source?
The plugin's own code is on GitHub under the Apache License 2.0. The bundled APIScout engine and the ApyGuard and APIScout logos are proprietary, as the repository's NOTICE file lists.
Bring API discovery into your coding agent.
Install the plugin, sign in to ApyGuard, and ask your agent to scan your first project.
Prefer the editor? See APIScout for VS Code