Claude Code

Install

/plugin marketplace add stackhawk/agent-skills-marketplace
/plugin install wingman@stackhawk

wingman is the StackHawk umbrella plugin — one install pulls the full skill set (hawkscan, stackhawk-api, data-seed, optimize).

Install the hawk CLI

The hawk CLI is a single self-contained binary — hawkop is now bundled in as hawk op, and no separate Java install is required.

brew tap stackhawk/cli && brew trust stackhawk/cli && brew install hawk

Then authenticate:

hawk init --browser

hawk init --browser opens your browser to approve access, then provisions and saves your API key automatically — no copy/paste. (On Windows, run hawk.exe init --browser.) Prefer to manage keys yourself? Create one at app.stackhawk.com → Settings → API Keys.

Verify

After installation, ask Claude: “What StackHawk skills do you have?” It should list the StackHawk skills — HawkScan scanning, API reporting, and more.

Usage

Ask Claude to scan your application:

Scan my app running on localhost:8080 for security vulnerabilities

Claude will generate a stackhawk.yml config if one doesn’t exist, validate it, run the scan, and present findings. When you finish building a feature, Claude automatically runs a security scan, fixes any findings, and rescans to verify.

Tips

• The agent checks if your app is running and will prompt you to start it if needed
• For authenticated endpoints, tell Claude your auth pattern (e.g., “my app uses JWT bearer tokens”) and it will configure the scan accordingly
• Use hawk validate config stackhawk.yml to debug config issues
• The --json-output flag is used automatically for structured findings parsing