Overview
What OpenAPI Guard checks, where it runs, and how to get started.
Documentation pages
OpenAPI Guard compares a local OpenAPI 3.x document with the endpoints your code implements and reports endpoint-level drift:
- OpenAPI operations with no supported implementation
- implemented endpoints absent from the OpenAPI contract
- HTTP method mismatches for otherwise matching routes
It supports Spring Boot controllers in Java and Kotlin, Express applications and
routers, and AWS Lambda handlers behind an API Gateway HTTP API (dispatched on
event.routeKey), in TypeScript or JavaScript. The VS Code extension and the CLI also
read NestJS controllers. Routing that cannot be analyzed is reported as an analysis
limitation rather than as missing implementations. Analysis is local: nothing about your source, your specification, or
your diagnostics leaves the machine.
Where it runs
| Surface | Status | Get it |
|---|---|---|
| VS Code extension | Released 0.4.1 | Visual Studio Marketplace |
| IntelliJ Platform plugin | Released 0.4.1 | JetBrains Marketplace |
| CLI | Released 0.4.1 | npm |
| MCP server | Included in the npm package | npm |
Quickest start
From a project that contains an OpenAPI document and supported sources:
npx --yes @stackblender/openapi-guard .Exit code 0 means clean, 1 means drift was found, 2 means the analysis or its
configuration failed.
Pages
Parameter, body, schema, and response checks are not part of the current scope.