Backend Validation
Hurl + websocat + oauth2c workflow for validating OIDC-authenticated backend APIs and WebSockets.
Test report
- Verdict
- Tested · Works
- Score
- Tested
- Jul 15, 2026
- Environment
- Claude Code 2.x (agent harness)
- Upstream re-checked
- Aug 10, 2026 · cd9f17b
Ran the actual A/B: a hand-written curl+jq bash validator vs. the skill's Hurl file with [Captures]/[Asserts], both executed live against a throwaway local HTTP server — the Hurl version is roughly half the code, declaratively chains the session id, and its companion token-script.sh sidesteps the ROPC failure mode the skill warns about (public PKCE clients reject password grant against real IdPs like Authentik).
Scored on four weighted criteria — install, triggering, output vs. baseline, docs. How scoring works
- Installs cleanly 5/5
- Triggers reliably 5/5
- Output vs. baseline 8/10
- Docs & honesty 4/5
What Backend Validation does
Provides a disciplined CLI workflow for validating backend REST/WebSocket endpoints end-to-end, including OIDC token acquisition via oauth2c with refresh-token caching in OS-native secret storage. Triggers when a user wants to smoke-test an API, write a Hurl regression test, debug a 401, or hit an authenticated WebSocket, and explicitly steps aside when a project already uses Postman/Bruno or the endpoint has no auth.
How to install Backend Validation
git clone https://github.com/johnkozaris/jko-claude-plugins
mkdir -p ~/.claude/skills
cp -r jko-claude-plugins/plugins/backend-validator/skills/backend-validation ~/.claude/skills/backend-validation
Skills live in ~/.claude/skills/ (global) or .claude/skills/
(per-project). Restart Claude Code after installing.
Commands — how to trigger Backend Validation
-
/backend-validationHurl + websocat + oauth2c workflow for validating OIDC-authenticated backend APIs and WebSockets.
It also activates on plain-language prompts like these:
-
write a regression test that hits my OIDC-protected API endpoint -
help me debug why my API keeps returning 401 with this bearer token -
smoke test this authenticated websocket connection end to end
Frequently asked questions
- Is the Backend Validation skill free?
- Yes. The skill itself is free from johnkozaris/jko-claude-plugins. SkillProof publishes the install command and an independent test verdict at no cost.
- Does Backend Validation work with Claude Code?
- We tested it with Claude Code 2.x (agent harness) on Jul 15, 2026. Verdict: Tested · Works. Ran the actual A/B: a hand-written curl+jq bash validator vs. the skill's Hurl file with [Captures]/[Asserts], both executed live against a throwaway local HTTP server — the Hurl version is roughly half the code, declaratively chains the session id, and its companion token-script.sh sidesteps the ROPC failure mode the skill warns about (public PKCE clients reject password grant against real IdPs like Authentik).
- What is the Backend Validation SkillProof Score?
- 8.8/10 — installs cleanly 5/5, triggers reliably 5/5, output vs. baseline 8/10, docs & honesty 4/5.
- How do I install Backend Validation?
- Copy the install command from this page, run it in your terminal, and restart Claude Code. Skills live in ~/.claude/skills/ (global) or .claude/skills/ inside a project.
- Can I use Backend Validation with Cursor, Copilot, Gemini CLI, Codex or other AI tools?
- The SKILL.md format is native to Claude (Claude Code, Desktop, claude.ai). The instructions inside adapt to other assistants: Cursor rules, GitHub Copilot instructions, Windsurf rules, Custom GPTs, AGENTS.md for OpenAI Codex, and GEMINI.md for Google Gemini CLI — our conversion guides cover each, and the free converter on the tools page does the wrapping for you.