# I Built a Claude Code Skill That Reverse-Engineers Undocumented APIs > Source: > Published: 2026-08-19 15:44:05+00:00 I Built a Claude Code Skill That Reverse-Engineers Undocumented APIs Because "the docs are in the code" is not a documentation strategy. The Week I Lost to Grepping I joined a new team last month. Day 1 task: add a feature to the billing service. Day 1 reality: I opened the API docs and realized they were from 2022. Half the routes had been rewritten. The other half never had docs to begin with. So I did what every backend dev does. I grepped. grep -r "app.get|app.post|router." src/ --include="*.js" Four hours later, I had a notebook full of endpoints, a headache, and zero confidence that I had found everything. I found routes that worked but were not documented. I found docs for routes that did not exist anymore. I found one GET /invoices/:id endpoint with zero auth checks that had been sitting there since 2022. This is normal. And it should not be. The Idea What if I could drop a single file into a repo and have Claude Code map the entire API layer for me? Not from annotations. Not from existing OpenAPI specs. From the actual code. So I built it. Meet API Archaeologist API Archaeologist is a Claude Code / Codex CLI skill that reads your source code and reverse-engineers your API layer. It finds: • Internal endpoints — REST, GraphQL, gRPC, WebSockets • External integrations — third-party APIs, webhooks, SDK clients • Auth flows — JWT, OAuth, API keys, session cookies, RBAC • Security gaps — unauthenticated routes, hardcoded secrets, missing rate limits • Dead code — auth middleware with no endpoints, orphaned routes And it generates two things: How It Works The skill is just a SKILL.md file. Claude Code reads it and follows the instructions. It: Why Not Just Use Swagger? Swagger and OpenAPI Generator are great if your codebase already has annotations, decorators, or an existing specification. This is for the other kind of codebase: • Legacy monoliths • Startups without proper API documentation • Projects where the original developers have left • APIs that evolved faster than their documentation It reads the actual source code instead of depending on existing documentation. Installation Claude Code: mkdir -p ~/.claude/skills/api-archaeologist curl -o ~/.claude/skills/api-archaeologist/SKILL.md [https://raw.githubusercontent.com/prasen-sky/api-archaeologist/main/skills/api-archaeologist/SKILL.md](https://raw.githubusercontent.com/prasen-sky/api-archaeologist/main/skills/api-archaeologist/SKILL.md) Codex CLI: mkdir -p ~/.codex/agents/skills/api-archaeologist curl -o ~/.codex/agents/skills/api-archaeologist/SKILL.md [https://raw.githubusercontent.com/prasen-sky/api-archaeologist/main/skills/api-archaeologist/SKILL.md](https://raw.githubusercontent.com/prasen-sky/api-archaeologist/main/skills/api-archaeologist/SKILL.md) Or clone the repository: git clone [https://github.com/prasen-sky/api-archaeologist.git](https://github.com/prasen-sky/api-archaeologist.git) cp api-archaeologist/skills/api-archaeologist/SKILL.md ~/.claude/skills/api-archaeologist/ Usage Navigate to your backend repository and run: claude /api-archaeologist Or with Codex: codex $api-archaeologist Then review the generated reports and verify the findings against your codebase. What I Learned The interesting part wasn't generating another API documentation tool. It was realizing how much useful information already exists inside a codebase. Routes, middleware, authentication, database calls, third-party APIs and request/response structures are already there. The problem is finding and connecting all of it. Limitations The OpenAPI output is a draft. Types and behavior may need manual verification. Dynamic or heavily meta-programmed routing can be harder to analyze. Large monorepos are better analyzed service by service. Roadmap • Frontend API consumer mapping • Postman collection export • CI/CD integration • Detection of newly introduced unauthenticated endpoints Try It If your API documentation is outdated, this might be useful. GitHub: [[https://github.com/prasen-sky/api-archaeologist](https://github.com/prasen-sky/api-archaeologist)] Try it on a repo and let me know what it finds.