@readystack/openapi-security-contract-lint

OpenAPI Security Contract Lint

Finds the lines in an OpenAPI file that publish an endpoint with no authentication, an API key in the query string, or an OAuth grant RFC 9700 forbids.

Install

npx @readystack/openapi-security-contract-lint file

Node 18+. The same 18 rules as the VS Code extension, from a terminal or CI.

Free

• Audit the OpenAPI file open in the editor against all 18 rules - every finding, every line number, every rule reference, nothing withheld
• --rules lists every rule

With a licence ($29 once)

• Sweep every OpenAPI document in the workspace, not just the open tab, and write a dated CSV/JSON/HTML report you keep with the release as evidence

@readystack/openapi-security-contract-lint --dir ./templates --report html --out report.html

An application-security consultant reading the same contract by hand bills $150-$250 an hour

Use from an AI agent (MCP)

Claude Code · Cursor · Windsurf · any MCP client - add to your MCP config:

{ "mcpServers": { "openapi-security-contract-lint": { "command": "npx", "args": ["-y", "@readystack/openapi-security-contract-lint", "--mcp"] } } }

Tools: check_text and check_file (free) · check_dir (licence). The agent gets every finding with the line number.

Use in CI

- name: OpenAPI Security Contract Lint
  run: npx -y @readystack/openapi-security-contract-lint --dir . --ci

(container: docker run --rm -v "$PWD:/work" getreadystack/openapi-security-contract-lint --dir /work --ci)

The folder sweep, reports and CI mode need one licence — one payment, no subscription. Set READYSTACK_LICENSE=<key> or run --license <key> once.

Get a licence