StackBlender OpenAPI Guard

Keep OpenAPI contracts and Spring Boot Java/Kotlin implementations synchronized while you code.

Navigate between a Spring mapping and its OpenAPI operation using VS Code's standard definition workflow:

OpenAPI Guard discovers local OpenAPI 3.x YAML/JSON specifications and extracts endpoints from Java and Kotlin Spring controllers. It reports missing, undocumented, and HTTP-method-mismatched endpoints as VS Code diagnostics and navigates between related contract and implementation locations.

Install

Install OpenAPI Guard from Visual Studio Marketplace, or run:

code --install-extension StackBlender.openapi-guard

Open a Spring Boot Java or Kotlin workspace containing an OpenAPI 3.x document. Analysis starts automatically. Review drift in the Problems panel, use F12 or Ctrl/Cmd+click to navigate between endpoints, and run OpenAPI Guard: Select OpenAPI Specification if automatic discovery finds the wrong contract.

Available now (Free)

• Local discovery and parsing of OpenAPI 3.x YAML/JSON specifications.
• Endpoint extraction from Java and Kotlin Spring controllers (@RestController, @Controller, @RequestMapping, and the five shortcut mapping annotations).
• Endpoint-level drift detection: missing implementations, undocumented implementations, and HTTP method mismatches, ignoring path-variable names.
• Automatic, incremental diagnostics in the editor and Problems panel.
• Bidirectional navigation: commands, editor context menu, and standard Go to Definition (F12 / Ctrl/Cmd+click), presenting all matching implementations.
• A headless CLI, a VS Code agent tool (#checkOpenApiContract), and a local MCP adapter, all sharing one deterministic, versioned report contract.

Planned for Pro (not yet implemented)

• Request/query/path parameter comparison.
• Request- and response-body DTO, field, nullability, and enum comparison.
• Response status/body inference and comparison.
• Project-wide "Analyze Entire Contract" summary view.
• Licensing and entitlement management.

Path-variable-name matching is intentionally relaxed in Free; parameter-name validation belongs to Pro. Computed or unresolved source paths are skipped rather than guessed to avoid false positives.

Agent integrations

Inside VS Code agent mode, the extension contributes the read-only #checkOpenApiContract tool. It analyzes the open workspace through the same report boundary as the CLI and editor diagnostics; OpenAPI Guard does not call a model or upload project content. Results contain at most 100 issues per invocation and include deterministic pagination metadata when another page is required.

A headless CLI and local stdio MCP adapter are bundled with the extension, but the Marketplace installation does not create a stable global executable path. Review the current CLI documentation and MCP documentation before integrating either surface.

Privacy

Application source and OpenAPI contracts are analyzed locally. Free analysis does not require a StackBlender account or network access, and OpenAPI Guard never uploads source, specifications, diagnostics, or repository metadata.

• Discovery, parsing, diffing, and report formatting all run on your machine.
• The VS Code agent tool and the CLI return the same locally-computed report; OpenAPI Guard does not call a language model or make its own model request.
• The local MCP adapter communicates over standard input/output and opens no network port.

Local-only operation is enforced by automated tests: CLI process tests run with common Node network entry points disabled, and a source-level guard test fails the suite if any network client (http/https/net/tls, fetch, WebSocket, or a third-party HTTP library) is introduced under src.

See the public documentation and support repository, report a bug, or report a security concern privately. Dependency licenses and attributions are bundled in THIRD_PARTY_NOTICES.md.