42Crunch
API security platform: audit OpenAPI contracts, scan live APIs, firewall them.
About
42Crunch secures APIs across the whole lifecycle in three moves. Audit statically analyzes your OpenAPI or GraphQL definition against 200+ security checks and gives the contract a 0-100 score with exploit explanations and remediation guidance. Scan then dynamically tests the live API endpoint to find where the implementation drifts from the contract. Protect generates a micro API firewall configuration straight from the hardened definition and deploys it as a 20MB sidecar in front of your services, enforcing the contract with sub-millisecond latency. Everything plugs into IDEs, GitHub Actions, Jenkins, and Azure DevOps so insecure contracts never reach main.
The Irish company was founded in 2016 by API-security veterans from IBM, and pricing is token-based with a free starter tier up to Team and Enterprise plans. The contract-first model is genuinely elegant, but it only protects what is described in the OpenAPI spec: undocumented shadow APIs stay out of scope, and GraphQL support is a separate subscription.
What it can do
- 200+ security audit checks on OpenAPI definitions with 0-100 scoring
- Dynamic conformance scanning of live API endpoints
- Micro API firewall generated from the OpenAPI contract
- IDE, GitHub Actions, Jenkins, and Azure DevOps integrations
- Token-based pricing with free starter tier
- GraphQL schema support
Setup
- Sign up for a free starter token or platform account.
- Import your OpenAPI definition and run the security audit.
- Fix critical findings until the score reaches your threshold.
- Add the audit GitHub Action to CI, run conformance scans in staging, and deploy the API firewall sidecar in production.
Prerequisites
OpenAPI (v2/v3) or GraphQL definition of your API; CI/CD or Kubernetes environment for firewall deployment.
Use cases
Works with
Trust score — 7/10
Scored 7/10 (TIER verified, metrics-v1). Evidence: founded 2016 in Ireland by IBM API-security veterans; Audit/Scan/Protect model documented in official docs with 200+ audit checks and 0-100 scoring; token-based pricing with free starter tier confirmed via vendor plugin docs; GitHub Action actively maintained. Strengths: developer-first contract model, real runtime protection, solid CI/CD integrations. Docked for: (1) protects only spec-described APIs; GraphQL is a separate subscription; (2) audit-score methodology is vendor-defined, not independently benchmarked. License: proprietary.
How the trust score is built
Full methodology →- Adoption · stars/downloads, log-scaled vs peers
- 7.0/10
- Maintenance · recency, releases, issue load
- 8.0/10
- Openness · license + docs
- 5.0/10
- Manual review · sanity read + red-flag check
- 7.0/10
- · Founded 2016 in Ireland by IBM API-security veterans (Isabelle Mauny, Jacques Declas)
- · Audit/Scan/Protect model documented in official docs: 200+ audit checks, 0-100 contract scoring
- · Token-based pricing with free starter tier (Individual 1,000 tokens/mo, Team 10/25, Enterprise)
- · GitHub Action (42crunch/api-security-audit-action) actively maintained, 37 stars
- · Audit-score methodology is vendor-defined, not independently benchmarked
- · Protects only spec-described APIs; GraphQL support is a separate subscription
Sources
Every fact above was checked against these sources. Where a claim comes from the provider and couldn't be independently verified, the text says so.