API Guard — Catch API & LLM Bugs Before You Run Your Code

API Guard is a VS Code extension that scans your JavaScript, TypeScript, and Python code for the mistakes that cause failed API calls — before you run the script and burn a request finding out. Built for developers working with the OpenAI API, Anthropic API, Claude API, and other LLM/AI SDKs, as well as anyone calling third-party REST APIs from Node.js or Python.

If you've ever run a script, waited, gotten a cryptic 401 Unauthorized or 429 Too Many Requests, dug through your code, fixed one small thing, and run it again — API Guard is built to stop that loop before it starts.

Why API Guard

Working with the OpenAI SDK, Anthropic SDK, or any LLM API means dealing with a specific, recurring category of bug: missing API keys, placeholder environment variables that never got replaced, hardcoded secrets that shouldn't be in source control, malformed request bodies missing required fields like model or max_tokens, and rate-limit errors that crash a script instead of retrying gracefully.

None of these bugs are complicated once you find them — but finding them usually means running the code, waiting for the response, reading the error, and going back to fix it. When each API call costs tokens, money, or rate-limit budget, that loop is expensive. API Guard catches the whole category statically, on save, before you run anything.

Features

Free — Core Checks

• Hardcoded API key / secret detection — flags OpenAI keys, Anthropic keys, and generic bearer tokens written directly into source files instead of loaded from environment variables.
• Placeholder environment variable detection — catches process.env.X usage where X was clearly left as "your-api-key-here", "changeme", "xxxxxxxx", or similar placeholder text instead of a real value.

Pro — Advanced Checks

• Model name typo detection — flags likely typos in model: "..." strings (e.g. gpt-4o-min instead of gpt-4o-mini) using fuzzy matching against known OpenAI and Anthropic model names. TypeScript won't catch this since the model name is just a string — a typo here silently fails at request time instead of at compile time.
• Missing retry / backoff detection — flags OpenAI and Anthropic API calls that have no try/catch or retry logic nearby, so a transient network error or a 429 rate-limit response crashes the whole script instead of retrying.
• Context window overflow estimation — estimates the token count of inline prompt content in a chat.completions.create or messages.create call and warns when it's approaching or exceeding the model's known context window limit, so you find out before the API call fails.

Supported Languages & SDKs

• JavaScript
• TypeScript
• Python
• OpenAI SDK / OpenAI API (chat.completions.create)
• Anthropic SDK / Anthropic API / Claude API (messages.create)

More languages and SDK integrations (Google Gemini, Cohere, Mistral, and others) are planned for future releases based on user requests.

How It Works

1. Install API Guard from the VS Code Marketplace.
2. Open any .js, .ts, or .py file that calls an API.
3. Save the file (Ctrl+S / Cmd+S).
4. API Guard scans the file automatically and reports issues directly in the editor (red/yellow squiggly underlines) and in the Problems panel (Ctrl+Shift+M / Cmd+Shift+M).
5. Fix the flagged issue before running your script, instead of after.

You can also trigger a manual scan any time via the Command Palette: Ctrl+Shift+P → "API Guard: Check This File".

Free vs. Pro

Pro is a one-time purchase — no subscription, no recurring charge. Pay once, use it forever, on as many of your own projects as you like.

To unlock Pro: Ctrl+Shift+P → "API Guard: Activate Pro License", then paste in the license key from your purchase confirmation email.

Who This Is For

• Developers building with the OpenAI API or Anthropic API / Claude API who want to catch request-shape mistakes before running a script.
• Anyone who has ever committed a hardcoded API key to source control by accident.
• Developers working in environments where every API call has a real cost — token usage, rate limits, or billing — and wants to avoid discovering a mistake the expensive way.
• Teams and solo developers who want a lightweight, static, on-save check instead of a heavyweight AI coding agent.

Frequently Asked Questions

Does this replace Copilot, Cursor, or other AI coding assistants? No — API Guard is a narrow, fast, static scanner focused specifically on API/LLM call correctness. It's meant to complement a coding assistant, not replace one.

Does this send my code anywhere? No. All scanning happens locally in your editor. Your code never leaves your machine.

Does it work with Python's os.environ as well as Node's process.env? Environment variable and secret detection currently targets JavaScript and TypeScript patterns most thoroughly; Python-specific pattern coverage is actively being expanded.

Is Pro a subscription? No — it's a one-time purchase. No recurring billing, no auto-renewal.

What if I find a false positive or a bug you missed? This extension is actively maintained. Feedback on missed detections or false positives directly shapes what gets added next.

Keywords

VS Code extension, OpenAI API checker, Anthropic API checker, Claude API linter, LLM API debugging, API key scanner, hardcoded secret detection, environment variable checker, prevent API errors, rate limit retry checker, token limit checker, context window checker, API request validator, pre-run code checker, static analysis for API calls, JavaScript API linter, TypeScript API linter, Python API linter, AI SDK debugging tool, prevent failed API calls, LLM prompt token estimator.

License

Free tier available to all users. Pro tier unlocked via one-time license key purchase.