API Reverse Engineering Toolkit — Testing skill for Claude Code

API Reverse-Engineering Toolkit

A [Claude Skill](https://docs.claude.com/en/docs/agents-and-tools/agent-skills/overview) for turning an undocumented HTTP API into a verified schema — plus a standalone verification script you can run outside of Claude entirely, in your own CI, once a spec or a generated client exists.

Point it at a list of URLs, a captured HAR file, or "here's how this site's frontend calls its backend," and it will:

1. Enumerate the real endpoint surface (including endpoints that never appear in any URL a human visited, pulled from the site's own client-side JS).
2. Classify each one — auth-gated and mutating endpoints get documented from code, not invoked.
3. Verify live — every endpoint in the resulting spec is either a real, captured response, or explicitly marked as inferred/unverified and why.
4. Choose a format deliberately — OpenAPI vs. Smithy vs. GraphQL vs. gRPC, based on what the API actually looks like on the wire, not on habit.
5. Recommend a code-generator, and optionally scaffold a production-ready starter SDK repo.

The throughline is **provenance**: nothing in the output spec should be a guess wearing the clothes of an observed fact.

This is a single-language-ecosystem repo — everything here is TypeScript/JavaScript, run on Node. There's no Python anywhere in this skill's own tooling.

Repository layout

.
├── SKILL.md                      the skill Claude reads
├── references/                    detail docs the skill points into
│   ├── recon-techniques.md          extracting endpoints from client-side JS
│   ├── format-selection.md          OpenAPI vs Smithy vs GraphQL vs gRPC
│   ├── generator-comparison.md      current TypeScript codegen landscape
│   └── starter-repo-checklist.md    scaffolding a generated SDK repo
├── scripts/
│   ├── verify_endpoints.ts          raw-API check, optionally + a generated client
│   └── adapters/                    client-adapter contract +