42Crunch API Security Platform

42crunch.com

From $9/mo Free plan WebWindowsmacOSLinuxAPISelf-hosted

Visit 42crunch.com

Spec score 9.5 #1 of 30 in API Security Software

Spec sheet

What it does: 42Crunch is a SaaS API-security platform covering definition auditing, live API scanning, runtime protection and monitoring.Read 14 Oct 2026 · docs.42crunch.com
Purpose: 42Crunch provides API security testing and runtime protection and extends its contract-driven governance to MCP servers used by AI agents.Read 30 Sep 2026 · 42crunch.com
Deployment: Enterprise deployment options listed by the maker are cloud, on-premises, and hybrid.Read 30 Sep 2026 · 42crunch.com
Integrations: Documented integrations include CI/CD plugins, IDE extensions, SonarQube and a Postman collection.Read 14 Oct 2026 · docs.42crunch.com
Privacy: The company says it commits to applicable privacy laws including GDPR, CCPA, UK GDPR, and Australia's APPs.Read 30 Sep 2026 · 42crunch.com
Compliance: The platform maps MCP security findings to NIST AI RMF, OWASP MCP Top 10, EU AI Act, ISO/IEC 42001, and CSA AICM controls.Read 30 Sep 2026 · 42crunch.com
Support: The Individual plan includes email support, Individual Pro includes community support, and enterprise pricing includes a dedicated support manager.Read 30 Sep 2026 · 42crunch.com
Headquarters: London, United KingdomRead 28 Sep 2026 · 42crunch.com
Company: The current website identifies the company as 42Crunch Ltd. and its leadership page names Jacques Declas and Philippe Leothaud as co-founders.Read 30 Sep 2026 · 42crunch.com
API formats: The platform supports OpenAPI 2, 3.0 and 3.1 definitions in JSON or YAML.Read 14 Oct 2026 · docs.42crunch.com
API testing: Its API security testing uses static and dynamic tests generated from OpenAPI definitions and maps findings to the OWASP API Security Top 10.Read 30 Sep 2026 · 42crunch.com
Audit coverage: The audit checks more than 200 contract structure, semantics, security and data-definition conditions.Read 14 Oct 2026 · docs.42crunch.com
CI/CD quality gates: Audit and Scan can run as Security Quality Gates that fail a pipeline when an API is non-conforming.Read 14 Oct 2026 · 42crunch.com
CI/CD support: The platform's CI/CD documentation lists Azure Pipelines, Bamboo, Bitbucket Pipelines, GitHub Actions, GitLab Pipelines, Jenkins, Tekton, and a generic Docker image for REST API static security testing.Read 30 Sep 2026 · docs.42crunch.com
Company founding and headquarters: LinkedIn lists the company as founded in 2016 and headquartered in Dublin.Read 14 Oct 2026 · linkedin.com
Company size: LinkedIn lists 42Crunch as a privately held company with 51–200 employees.Read 14 Oct 2026 · linkedin.com
Component licences: GitHub lists the vscode-openapi and scan-manager repositories under AGPL-3.0 and the API security audit action under Apache-2.0.Read 14 Oct 2026 · github.com
Documentation: The documentation site covers audit, scan, protection, integrations, tasks, concepts, support material and release notes.Read 14 Oct 2026 · docs.42crunch.com
Dynamic scan: API Scan generates traffic against a live endpoint to test implementation conformance and security.Read 14 Oct 2026 · docs.42crunch.com
Editor capabilities: The editor provides IntelliSense, linting, navigation, schema enforcement, SwaggerUI or ReDoc preview, snippets and Try-it execution.Read 14 Oct 2026 · marketplace.visualstudio.com
Funding and ownership: Crunchbase describes 42Crunch as private, Series A, headquartered in London, with Adara Ventures and Energy Impact Partners among its investors.Read 14 Oct 2026 · crunchbase.com
GraphQL support: GraphQL schema files are supported, but introspection files are not and GraphQL requires a separate subscription.Read 14 Oct 2026 · docs.42crunch.com
IDE support: The free OpenAPI editor supports VS Code, IntelliJ-based IDEs and Eclipse, with Visual Studio Enterprise support added in 2026.Read 14 Oct 2026 · docs.42crunch.com
Independent pricing criticism: FAUN.dev scored pricing transparency low and said team or enterprise use requires a sales-sized subscription.Read 14 Oct 2026 · faun.dev
Latest release: The September 30, 2026 release added MCP security governance in platform version 1.60.x.Read 14 Oct 2026 · docs.42crunch.com
Limit: setup complexity: Reviewers report setup and pipeline troubleshooting friction, a learning curve for advanced features and limited report or policy customization.Read 14 Oct 2026 · gartner.com
Limit: specification dependence: Reviewers say incomplete or outdated OpenAPI contracts reduce the effectiveness of audits, scans and runtime protection.Read 14 Oct 2026 · gartner.com
Local scanning: The free API Scan mode runs locally and does not upload the API file to 42Crunch.Read 14 Oct 2026 · marketplace.visualstudio.com
MCP discovery: The platform discovers MCP servers across registries, gateways, and repositories and generates contracts for their advertised tools, resources, and prompts.Read 30 Sep 2026 · 42crunch.com
Monitoring: API Firewall logs provide views of callers, popular paths, transaction errors and breach attempts.Read 14 Oct 2026 · docs.42crunch.com
Network requirement: Freemium services require network access to stateless.42crunch.com.Read 14 Oct 2026 · marketplace.visualstudio.com
Notable limitation: The CI/CD documentation says GraphQL federation is not supported in CI/CD integration, and the Jenkins instructions state GraphQL scanning requires a separate subscription.Read 30 Sep 2026 · docs.42crunch.com
Notable news: 42Crunch announced an API Contract Generator for developer IDEs on January 19, 2026.Read 14 Oct 2026 · 42crunch.com
Praise: early vulnerability detection: Gartner reviewers repeatedly praise scanning API specifications early, improving security practices and finding issues before exposure.Read 14 Oct 2026 · gartner.com
Praise: lifecycle automation: Gartner reviewers praise end-to-end lifecycle coverage, CI/CD integration, governance, reporting and reduced manual effort.Read 14 Oct 2026 · gartner.com
Privacy commitments: The company says it follows GDPR, CCPA, UK GDPR and Australian privacy principles.Read 14 Oct 2026 · 42crunch.com
Public API and extensibility: The vendor publishes CI/CD actions, IDE plugins, a Kubernetes scan manager and sample repositories on GitHub.Read 14 Oct 2026 · github.com
Rating on Capterra: 0.0 out of 5 from 0 reviewsRead 14 Oct 2026 · capterra.com
Rating on G2: 0 out of 5 from 0 reviewsRead 14 Oct 2026 · g2.com
Rating on Gartner Peer Insights: 4.1 out of 5 from 24 ratingsRead 14 Oct 2026 · gartner.com
Rating on GetApp: 0 out of 5 from 0 reviewsRead 14 Oct 2026 · getapp.com
Runtime blocking: The firewall blocks undeclared methods, parameters, schemas, error codes and invalid message data by default.Read 14 Oct 2026 · docs.42crunch.com
Runtime firewall: API Protection deploys an API-native micro-firewall that enforces rules generated from the API contract.Read 14 Oct 2026 · docs.42crunch.com
Runtime protection: The runtime micro-firewall builds an allowlist from the API contract and blocks undeclared traffic with stated sub-millisecond overhead.Read 30 Sep 2026 · 42crunch.com
Security certification: 42Crunch states that it is ISO/IEC 27001 certified and independently audited.Read 14 Oct 2026 · 42crunch.com
Security testing feature: The current testing product advertises 300-plus automated checks mapped to the OWASP API Security Top 10.Read 14 Oct 2026 · 42crunch.com
Self-hosting: Enterprise deployment options are described as cloud, on-premises or hybrid.Read 14 Oct 2026 · 42crunch.com
Static audit: API Security Audit performs static analysis of contracts and assigns a risk and standards-compliance score.Read 14 Oct 2026 · docs.42crunch.com
Trial terms: The free trial signup page says the 14-day trial requires a corporate email and no credit card.Read 30 Sep 2026 · 42crunch.com

Plans and prices

Free Free AI coding plugin · OpenAPI audit · vulnerability scans · automatic fixes · enough tokens to try the product Read 30 Sep 2026 · 42crunch.com

Starter Free 14 days Single user · API SAST & DAST · vulnerability and identity scans · default quality gate · IDE integration · community support Read 14 Oct 2026 · 42crunch.com

Individual $9 a month $9 / month 1,000 security tokens/month · 1 user · +$0.03 per extra token · coding agents · API scans · IDE integration · email support Read 30 Sep 2026 · 42crunch.com

Individual $9 a month monthly or annually 1,000 security tokens/month · 1 user · API SAST & DAST · vulnerability and identity scans · IDE integration · email support Read 14 Oct 2026 · 42crunch.com

Individual Pro $20 a month $20 / month 3,000 security tokens/month · 1 user · +$0.025 per extra token · coding agents · API scans · IDE integration · community support Read 30 Sep 2026 · 42crunch.com

Individual Pro $20 a month monthly or annually 3,000 security tokens/month · 1 user · API SAST & DAST · vulnerability and identity scans · IDE integration · email support Read 14 Oct 2026 · 42crunch.com

Team 10 $349 a month $3,560 annually Up to 10 users · up to 250 endpoints · unlimited tokens · shared API workspace · drift scans · customizable dictionaries and quality gates Read 14 Oct 2026 · 42crunch.com

Team 25 $599 a month $6,000 annually 11–25 users · up to 1,000 endpoints · unlimited tokens · shared API workspace · drift scans · customizable dictionaries and quality gates Read 14 Oct 2026 · 42crunch.com

Enterprise Priced on request Scoped to APIs, MCP servers, and users · dedicated encrypted tenant · SSO · unlimited context · dedicated support manager · cloud, on-prem, or hybrid Read 30 Sep 2026 · 42crunch.com

Enterprise API Security Platform Priced on request Unlimited tokens · runtime threat protection · Secure MCP Server · CI/CD, gateway and SIEM/SOC integrations · SSO and audit logs · dedicated encrypted tenant · dedicated support manager Read 14 Oct 2026 · 42crunch.com

Every 42Crunch API Security Platform plan and price →