Backend Validation

Hurl + websocat + oauth2c workflow for validating OIDC-authenticated backend APIs and WebSockets.

Tested · Works

Test report

Verdict
Tested · Works
Score
8.8/10
Tested
Jul 15, 2026
Environment
Claude Code 2.x (agent harness)
Upstream re-checked
Aug 10, 2026 · cd9f17b

Ran the actual A/B: a hand-written curl+jq bash validator vs. the skill's Hurl file with [Captures]/[Asserts], both executed live against a throwaway local HTTP server — the Hurl version is roughly half the code, declaratively chains the session id, and its companion token-script.sh sidesteps the ROPC failure mode the skill warns about (public PKCE clients reject password grant against real IdPs like Authentik).

Scored on four weighted criteria — install, triggering, output vs. baseline, docs. How scoring works

  • Installs cleanly 5/5
  • Triggers reliably 5/5
  • Output vs. baseline 8/10
  • Docs & honesty 4/5

What Backend Validation does

Provides a disciplined CLI workflow for validating backend REST/WebSocket endpoints end-to-end, including OIDC token acquisition via oauth2c with refresh-token caching in OS-native secret storage. Triggers when a user wants to smoke-test an API, write a Hurl regression test, debug a 401, or hit an authenticated WebSocket, and explicitly steps aside when a project already uses Postman/Bruno or the endpoint has no auth.

How to install Backend Validation

git clone https://github.com/johnkozaris/jko-claude-plugins
mkdir -p ~/.claude/skills
cp -r jko-claude-plugins/plugins/backend-validator/skills/backend-validation ~/.claude/skills/backend-validation

Skills live in ~/.claude/skills/ (global) or .claude/skills/ (per-project). Restart Claude Code after installing.

Commands — how to trigger Backend Validation

  • /backend-validation Hurl + websocat + oauth2c workflow for validating OIDC-authenticated backend APIs and WebSockets.

It also activates on plain-language prompts like these:

  • write a regression test that hits my OIDC-protected API endpoint
  • help me debug why my API keeps returning 401 with this bearer token
  • smoke test this authenticated websocket connection end to end

Frequently asked questions

Is the Backend Validation skill free?
Yes. The skill itself is free from johnkozaris/jko-claude-plugins. SkillProof publishes the install command and an independent test verdict at no cost.
Does Backend Validation work with Claude Code?
We tested it with Claude Code 2.x (agent harness) on Jul 15, 2026. Verdict: Tested · Works. Ran the actual A/B: a hand-written curl+jq bash validator vs. the skill's Hurl file with [Captures]/[Asserts], both executed live against a throwaway local HTTP server — the Hurl version is roughly half the code, declaratively chains the session id, and its companion token-script.sh sidesteps the ROPC failure mode the skill warns about (public PKCE clients reject password grant against real IdPs like Authentik).
What is the Backend Validation SkillProof Score?
8.8/10 — installs cleanly 5/5, triggers reliably 5/5, output vs. baseline 8/10, docs & honesty 4/5.
How do I install Backend Validation?
Copy the install command from this page, run it in your terminal, and restart Claude Code. Skills live in ~/.claude/skills/ (global) or .claude/skills/ inside a project.
Can I use Backend Validation with Cursor, Copilot, Gemini CLI, Codex or other AI tools?
The SKILL.md format is native to Claude (Claude Code, Desktop, claude.ai). The instructions inside adapt to other assistants: Cursor rules, GitHub Copilot instructions, Windsurf rules, Custom GPTs, AGENTS.md for OpenAI Codex, and GEMINI.md for Google Gemini CLI — our conversion guides cover each, and the free converter on the tools page does the wrapping for you.