
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
spring-api-scanner
Advanced tools
CLI for scanning Spring Boot Java/Kotlin APIs and generating OpenAPI + UI output
Scan a Spring Boot Java/Kotlin service and generate:
openapi.json (OpenAPI 3.0)index.html + ui-data.json)scan-warnings.json)No code/dependency changes are required in the target Spring service.
npm install
npm run build
Serve generated docs:
node dist/index.js /path/to/spring-service --serve --port 3000
Export static docs only:
node dist/index.js /path/to/spring-service --no-serve --output ./api-docs
Scan directly from Bitbucket repo + branch:
node dist/index.js --repo https://bitbucket.org/acme/orders-service.git --branch develop --no-serve --output ./api-docs
spring-api-scanner --help
Usage: spring-api-scanner <projectPath> [options]
spring-api-scanner --repo <git-url> [options]
Scan a Spring Boot Java/Kotlin project and generate OpenAPI documentation and a static UI.
Options:
--repo <url> Clone and scan from a remote git repository (supports Bitbucket)
--branch <name> Branch to clone with --repo (default: main)
--keep-clone Keep cloned repo directory after scan (default: cleanup)
--serve Start a local server to serve the generated docs
--no-serve Only generate static files (default)
--port <number> Port for the server (default: 3000)
--output <path> Output directory for generated files (default: ./api-docs)
--title <string> API title for documentation (default: "Spring API Docs")
--version <string> API version for documentation (default: 1.0.0)
--strict Exit with non-zero code on unresolved critical issues
--help Show this help message
@RestController@RequestMapping@GetMapping, @PostMapping, @PutMapping, @DeleteMapping, @PatchMapping@RequestMapping(method = ...)@PathVariable, @RequestParam, @RequestHeader, @RequestBodyMono<T>/Flux<T>)data class, Java class, and Java recordenum class and Java enum@NotNull, @Size)The generated UI includes:
/) - Press / to focus the search boxsnake_case and camelCaseSchema field names follow these rules:
snake_casecamelCase@JsonNaming(PropertyNamingStrategies.SnakeCaseStrategy::class), fields become snake_case@JsonNaming(PropertyNamingStrategies.LowerCamelCaseStrategy::class), fields stay camelCaseThe UI naming toggle only changes how schema/example keys and curl body keys are displayed.
It does not rewrite the generated openapi.json source of truth.
Common Java/Kotlin/JVM types are mapped, including:
String, Char, char, Int, int, Integer, Long, long, Short, short, Byte, byte, unsigned numeric variants, Boolean, boolean, Float, float, Double, double, BigDecimal, BigIntegerInstant, LocalDate, LocalDateTime, OffsetDateTime, ZonedDateTimeUUID, ByteArray, AnyList, Set, Collection, Page, Array, primitive arrays, Java arrays (T[]), Map, ResponseEntity<T>, Mono<T>, Flux<T>, Publisher<T>, Optional<T>data class, Java class, and Java record), e.g. ApiResponse<UserDto>Generic DTO component names are materialized with type arguments (example: ApiResponseOfUserDto) to keep schema resolution deterministic.
npm test
npm run build
Integration + golden-file tests are under tests/integration.test.ts and tests/golden/openapi.sample-service.json.
See docs/ROADMAP.md for phased priorities (v0.2, v0.3, v1.0).
FAQs
CLI for scanning Spring Boot Java/Kotlin APIs and generating OpenAPI + UI output
We found that spring-api-scanner demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.