API Lens

AST-powered Express.js API security, quality and health analysis directly inside VS Code.

API Lens is a developer-focused VS Code extension for analyzing Node.js and Express.js API code using AST-based static analysis. It automatically discovers server-side Express routes, evaluates authentication protection, input validation, async error handling, HTTP status code accuracy, and security risks, and computes a project-level 0–100 API Health Score.

All analysis runs 100% locally inside VS Code without uploading source code to external cloud servers or intercepting runtime network traffic.

💡 Intelligent Server vs. Client Context Distinction

API Lens parses AST nodes to distinguish server-side Express route declarations (router.get, app.post) from client-side HTTP calls. It avoids false positives by ignoring frontend API client calls such as:

• api.patch(...)
• axios.patch(...)
• fetch(...)

API Lens Interactive Webview Dashboard displaying API Health Score, metric breakdowns, top issues, and quick export actions.

✨ Why API Lens?

• Zero Runtime Interception: Performs static analysis directly on source code without needing to start servers or record live traffic.
• Deep Express AST Parsing: Resolves complex multi-level router mount chains (e.g. app.use('/api/v1', apiRouter) → apiRouter.use('/auth', authRouter) → PATCH /api/v1/auth/profile).
• 3-Tiered Validation Insights: Distinguishes missing validation (NONE), basic manual checks (BASIC), and schema-based validation (STRONG).
• Actionable Diagnostics: Integrates seamlessly with VS Code Problems panel and Quick Fixes for immediate remediation.
• Automated Artifact Generation: Instantly exports Markdown API documentation and Postman v2.1 collections.

📊 API Health Score

API Lens calculates a transparent 0–100 API Health Score evaluating your codebase across 7 core quality dimensions:

Example Dashboard Result: 99 / 100 — Excellent (Project-level quality indicator calculated dynamically during scans).

🚀 Features

🔍 Express Route Discovery

Discovers Express route definitions and recursively resolves nested router mount paths.

app.use('/api/v1', apiRouter);
apiRouter.use('/auth', authRouter);
authRouter.patch('/profile', protect, updateProfile);

// → Resolved Endpoint: PATCH /api/v1/auth/profile

🛡️ Authentication Analysis

Detects standard authentication middleware (protect, authMiddleware, verifyToken, authenticate, passport, jwt.verify) and flags sensitive routes lacking protection.

✅ Input Validation Analysis

Classifies validation quality into 3 levels:

• NONE → Request body consumed without validation (🔴 Missing Input Validation warning).
• BASIC → Manual presence or required-field checks (🟡 Weak Input Validation suggestion).
• STRONG → Schema-based validation (Zod, Joi, Yup, express-validator, validator.js) (🟢 No issue).

⚠️ Async Error Handling

Detects unhandled await operations in async route handlers lacking try/catch blocks or next(err) error propagation.

📡 HTTP Status Code Analysis

Flags HTTP status code mismatches (such as returning HTTP 201 Created with a "User not found" message) and suggests standard HTTP status codes (e.g. 404 Not Found).

🔐 Security Analysis

Identifies hardcoded API keys and secrets while recognizing environment variable lookups (process.env.JWT_SECRET) as secure.

🐛 VS Code Problems Integration & Quick Fixes

Displays diagnostics directly in the native VS Code Problems panel with clickable line numbers and CodeActions for quick resolution.

📸 Dashboard

Access the interactive API Lens Dashboard from the VS Code Activity Bar ($(shield)) to view:

• Overall API Health Score (0–100 grade)
• Discovered Route Count & issue severity breakdown
• Category Metric Progress Bars (Validation, Auth, Error Handling, Status Codes, Security)
• Top Actionable Issues List with one-click code navigation
• Quick Export Buttons (Scan Project, Generate Docs, Export Postman Collection)

🛠️ Supported Technology

• Runtimes & Frameworks: Node.js, Express.js (App, Router, Controllers, Middleware)
• Languages: JavaScript, TypeScript (CommonJS & ES Modules, JSX/TSX parsing)
• Validation Ecosystems: Zod, Joi, Yup, express-validator, validator.js
• Auth Ecosystems: JWT, Passport.js, custom Express auth middleware

⚡ Installation

Marketplace (Recommended)

1. Open VS Code.
2. Open Extensions (Ctrl+Shift+X / Cmd+Shift+X).
3. Search for API Lens.
4. Click Install.

Or install directly from the VS Code Marketplace.

VSIX Package (Offline / Developer)

code --install-extension apilens-0.1.5.vsix

🔍 Usage & Workflow

1. Open any Node.js / Express project folder in VS Code.
2. API Lens automatically detects the Express API workspace.
3. Run API Lens: Scan Project from the Command Palette (Ctrl+Shift+P / Cmd+Shift+P).
4. Review your API Health Score in the Dashboard or Activity Bar.
5. Inspect issues in the VS Code Problems panel.
6. Generate Markdown API Docs or Postman Collections when needed.

Available Commands

• apilens.scanProject → API Lens: Scan Project
• apilens.showHealth → API Lens: Show API Health
• apilens.generateDocs → API Lens: Generate API Documentation
• apilens.generatePostman → API Lens: Generate Postman Collection
• apilens.generateSample → API Lens: Generate Sample Request
• apilens.refreshAnalysis → API Lens: Refresh Analysis

🧠 How It Works

Source Code (.js / .ts)
         │
         ▼
    AST Parsing
         │
         ▼
Express Route Discovery & Mount Chain Resolution
         │
         ▼
Static Analysis (Auth, Validation, Error Handling, Security, Status Codes)
         │
         ▼
Issue Aggregation & 0–100 API Health Scoring
         │
         ▼
VS Code Dashboard & Problems Panel Integration

API Lens performs static AST analysis directly on source files without invoking runtime code or capturing live network packets.

📦 Generated Artifacts

• api-docs/API_DOCUMENTATION.md: Complete Markdown documentation for all discovered endpoints.
• api-docs/APILENS.postman_collection.json: Pre-formatted Postman v2.1 collection with {{baseUrl}} and {{token}} environment variables.
• Sample Requests: Generate ready-to-use cURL commands, HTTP requests, and sample JSON payloads for any route.

⚠️ Known Limitations

• Dynamic Route Paths: Route paths constructed via complex dynamic runtime evaluations may not be fully resolved statically.
• Custom Auth Naming: Non-standard authentication patterns without common middleware identifiers may require alignment with recognized middleware naming conventions.
• Framework Focus: Primary static analysis optimization is currently designed for Express.js API codebases.

🔐 Privacy & Security

• 🔒 100% Local Execution: Analysis runs strictly inside your local VS Code instance.
• 🚫 No Code Uploads: Your source code is never transmitted to remote cloud servers or third-party APIs.
• 🛡️ Secret Protection: Exported Postman collections and documentation substitute placeholders ({{token}}, {{baseUrl}}) to prevent credential leakage.

🤝 Contributing

Contributions are welcome! To set up the development environment:

# 1. Clone repository
git clone https://github.com/kumarshobhit-1/apilens.git
cd APILens

# 2. Install dependencies
npm install

# 3. Run test suite
npm test

# 4. Build production bundle
npm run build

📄 License

This project is licensed under the MIT License.

👨‍💻 Developer

Shobhit Kumar
Backend Developer | Software Development Engineer

Built API Lens as a developer-focused VS Code extension for improving the quality, security, and maintainability of Node.js / Express.js APIs.

• 🌐 Portfolio: https://kumarshobhit.tech/
• 💼 LinkedIn: https://www.linkedin.com/in/kumarshobhit1/
• 🐙 GitHub: https://github.com/kumarshobhit-1
• ✉️ Email: maishobhitkumar@gmail.com

Built with ❤️ for Node.js and Express developers.
Created by Shobhit Kumar