I Built a Claude Code Skill That Reverse-Engineers Undocumented APIs

A developer has created API Archaeologist, a Claude Code and Codex CLI skill that reverse-engineers undocumented APIs by reading source code. The tool maps internal endpoints, external integrations, auth flows, security gaps, and dead code, generating OpenAPI specs and security reports. It is designed for legacy monoliths, startups without proper API documentation, and projects where original developers have left.

I Built a Claude Code Skill That Reverse-Engineers Undocumented APIs Because "the docs are in the code" is not a documentation strategy. The Week I Lost to Grepping I joined a new team last month. Day 1 task: add a feature to the billing service. Day 1 reality: I opened the API docs and realized they were from 2022. Half the routes had been rewritten. The other half never had docs to begin with. So I did what every backend dev does. I grepped. grep -r "app.get|app.post|router." src/ --include=" .js" Four hours later, I had a notebook full of endpoints, a headache, and zero confidence that I had found everything. I found routes that worked but were not documented. I found docs for routes that did not exist anymore. I found one GET /invoices/:id endpoint with zero auth checks that had been sitting there since 2022. This is normal. And it should not be. The Idea What if I could drop a single file into a repo and have Claude Code map the entire API layer for me? Not from annotations. Not from existing OpenAPI specs. From the actual code. So I built it. Meet API Archaeologist API Archaeologist is a Claude Code / Codex CLI skill that reads your source code and reverse-engineers your API layer. It finds: • Internal endpoints — REST, GraphQL, gRPC, WebSockets • External integrations — third-party APIs, webhooks, SDK clients • Auth flows — JWT, OAuth, API keys, session cookies, RBAC • Security gaps — unauthenticated routes, hardcoded secrets, missing rate limits • Dead code — auth middleware with no endpoints, orphaned routes And it generates two things: How It Works The skill is just a SKILL.md file. Claude Code reads it and follows the instructions. It: Why Not Just Use Swagger? Swagger and OpenAPI Generator are great if your codebase already has annotations, decorators, or an existing specification. This is for the other kind of codebase: • Legacy monoliths • Startups without proper API documentation • Projects where the original developers have left • APIs that evolved faster than their documentation It reads the actual source code instead of depending on existing documentation. Installation Claude Code: mkdir -p ~/.claude/skills/api-archaeologist curl -o ~/.claude/skills/api-archaeologist/SKILL.md https://raw.githubusercontent.com/prasen-sky/api-archaeologist/main/skills/api-archaeologist/SKILL.md https://raw.githubusercontent.com/prasen-sky/api-archaeologist/main/skills/api-archaeologist/SKILL.md Codex CLI: mkdir -p ~/.codex/agents/skills/api-archaeologist curl -o ~/.codex/agents/skills/api-archaeologist/SKILL.md https://raw.githubusercontent.com/prasen-sky/api-archaeologist/main/skills/api-archaeologist/SKILL.md https://raw.githubusercontent.com/prasen-sky/api-archaeologist/main/skills/api-archaeologist/SKILL.md Or clone the repository: git clone https://github.com/prasen-sky/api-archaeologist.git https://github.com/prasen-sky/api-archaeologist.git cp api-archaeologist/skills/api-archaeologist/SKILL.md ~/.claude/skills/api-archaeologist/ Usage Navigate to your backend repository and run: claude /api-archaeologist Or with Codex: codex $api-archaeologist Then review the generated reports and verify the findings against your codebase. What I Learned The interesting part wasn't generating another API documentation tool. It was realizing how much useful information already exists inside a codebase. Routes, middleware, authentication, database calls, third-party APIs and request/response structures are already there. The problem is finding and connecting all of it. Limitations The OpenAPI output is a draft. Types and behavior may need manual verification. Dynamic or heavily meta-programmed routing can be harder to analyze. Large monorepos are better analyzed service by service. Roadmap • Frontend API consumer mapping • Postman collection export • CI/CD integration • Detection of newly introduced unauthenticated endpoints Try It If your API documentation is outdated, this might be useful. GitHub: https://github.com/prasen-sky/api-archaeologist https://github.com/prasen-sky/api-archaeologist Try it on a repo and let me know what it finds.