StackHawk Documentation StackHawk Logo HawkDocs
ai security
agent skills
claude code

No results found

Try different keywords or check your spelling

Search documentation

Find guides, API references, and more

↑ ↓ ↵ esc

Claude Code

/plugin marketplace add stackhawk/agent-skills-marketplace
/plugin install wingman@stackhawk

wingman is the StackHawk umbrella plugin — one install pulls the full skill set (hawkscan, stackhawk-api, data-seed, optimize).

The hawk CLI is a single self-contained binary — hawkop is now bundled in as hawk op, and no separate Java install is required.

brew tap stackhawk/cli && brew trust stackhawk/cli && brew install hawk

Install hawk with the hawk CLI install script, then add it to your PATH:

curl -fsSL https://download.stackhawk.com/hawk/install.sh | sh
export PATH="$HOME/.hawk/bin:$PATH"

Download and run the hawk.exe MSI installer from the downloads page — self-contained, no Java required. Or install hawk for your user only, with no administrator access, using the hawk CLI install script:

irm https://download.stackhawk.com/hawk/install.ps1 | iex
$env:Path = "$env:USERPROFILE\.hawk\bin;$env:Path"

CMD users: run the cmd.exe version of the install script instead:

curl -fsSL -o "%TEMP%\hawk-install.bat" https://download.stackhawk.com/hawk/install.bat && call "%TEMP%\hawk-install.bat"
set "PATH=%USERPROFILE%\.hawk\bin;%PATH%"

Then authenticate:

hawk init --browser

hawk init --browser opens your browser to approve access, then provisions and saves your API key automatically — no copy/paste. (On Windows, run hawk.exe init --browser.) Prefer to manage keys yourself? Create one at app.stackhawk.com → Settings → API Keys.

After installation, ask Claude: “What StackHawk skills do you have?” It should list the StackHawk skills — HawkScan scanning, API reporting, and more.

Ask Claude to scan your application:

Scan my app running on localhost:8080 for security vulnerabilities. Explain each step you take and each decision you make along the way.

Claude will generate a stackhawk.yml config if one doesn’t exist, validate it, run the scan, and present findings. When you finish building a feature, Claude automatically runs a security scan, fixes any findings, and rescans to verify.

  • The agent checks if your app is running and will prompt you to start it if needed
  • For authenticated endpoints, tell Claude your auth pattern (e.g., “my app uses JWT bearer tokens”) and it will configure the scan accordingly
  • Use hawk validate config stackhawk.yml to debug config issues
  • The --json-output flag is used automatically for structured findings parsing

Your privacy settings

We use first and third party cookies to ensure that we give you the best experience on our website and in our products.

Privacy Policy