I Built a Claude Code Skill That Reverse-Engineers Undocumented APIs

I Built a Claude Code Skill That Reverse-Engineers Undocumented APIs

Because "the docs are in the code" is not a documentation strategy.

The Week I Lost to Grepping

I joined a new team last month. Day 1 task: add a feature to the billing service.

Day 1 reality: I opened the API docs and realized they were from 2022. Half the routes had been rewritten. The other half never had docs to begin with.

So I did what every backend dev does. I grepped.

grep -r "app.get|app.post|router." src/ --include="*.js"

Four hours later, I had a notebook full of endpoints, a headache, and zero confidence that I had found everything.

I found routes that worked but were not documented. I found docs for routes that did not exist anymore. I found one GET /invoices/:id endpoint with zero auth checks that had been sitting there since 2022.

This is normal. And it should not be.

The Idea

What if I could drop a single file into a repo and have Claude Code map the entire API layer for me?

Not from annotations. Not from existing OpenAPI specs. From the actual code.

So I built it.

Meet API Archaeologist

API Archaeologist is a Claude Code / Codex CLI skill that reads your source code and reverse-engineers your API layer.

It finds:

• Internal endpoints — REST, GraphQL, gRPC, WebSockets
• External integrations — third-party APIs, webhooks, SDK clients
• Auth flows — JWT, OAuth, API keys, session cookies, RBAC
• Security gaps — unauthenticated routes, hardcoded secrets, missing rate limits
• Dead code — auth middleware with no endpoints, orphaned routes

And it generates two things:

1. API_DISCOVERY.md — A complete catalog with Mermaid diagrams
2. openapi-draft.yaml — A draft OpenAPI spec

How It Works

The skill is just a SKILL.md file. Claude Code reads it and follows the instructions.

It:

1. Discovers route definitions
2. Traces handlers, DTOs, middleware, services, and database calls
3. Maps authentication and authorization
4. Finds external API calls and integrations
5. Flags potential security and reliability risks
6. Generates API_DISCOVERY.md and openapi-draft.yaml

Why Not Just Use Swagger?

Swagger and OpenAPI Generator are great if your codebase already has annotations, decorators, or an existing specification.

This is for the other kind of codebase:

• Legacy monoliths
• Startups without proper API documentation
• Projects where the original developers have left
• APIs that evolved faster than their documentation

It reads the actual source code instead of depending on existing documentation.

Installation

Claude Code:

mkdir -p ~/.claude/skills/api-archaeologist

curl -o ~/.claude/skills/api-archaeologist/SKILL.md
https://raw.githubusercontent.com/prasen-sky/api-archaeologist/main/skills/api-archaeologist/SKILL.md

Codex CLI:

mkdir -p ~/.codex/agents/skills/api-archaeologist

curl -o ~/.codex/agents/skills/api-archaeologist/SKILL.md
https://raw.githubusercontent.com/prasen-sky/api-archaeologist/main/skills/api-archaeologist/SKILL.md

Or clone the repository:

git clone https://github.com/prasen-sky/api-archaeologist.git

cp api-archaeologist/skills/api-archaeologist/SKILL.md ~/.claude/skills/api-archaeologist/

Usage

Navigate to your backend repository and run:

claude /api-archaeologist

Or with Codex:

codex $api-archaeologist

Then review the generated reports and verify the findings against your codebase.

What I Learned

The interesting part wasn't generating another API documentation tool.

It was realizing how much useful information already exists inside a codebase.

Routes, middleware, authentication, database calls, third-party APIs and request/response structures are already there.

The problem is finding and connecting all of it.

Limitations

The OpenAPI output is a draft. Types and behavior may need manual verification.

Dynamic or heavily meta-programmed routing can be harder to analyze.

Large monorepos are better analyzed service by service.

Roadmap

• Frontend API consumer mapping
• Postman collection export
• CI/CD integration
• Detection of newly introduced unauthenticated endpoints

Try It

If your API documentation is outdated, this might be useful.

GitHub:
[https://github.com/prasen-sky/api-archaeologist]

Try it on a repo and let me know what it finds.