Claude Code

Install

/plugin marketplace add stackhawk/agent-skills-marketplace
/plugin install hawkscan@stackhawk
/plugin install stackhawk-api@stackhawk

Install hawk and hawkop

brew tap stackhawk/cli && brew install hawk hawkop

Then authenticate both CLIs:

hawk init
hawkop init

hawk init prompts for your API key (hawk.xxxxxxxxxx.xxxxxxxxxx) — get one at app.stackhawk.com → Settings → API Keys. hawkop init picks up the key automatically and prompts for your default organization.

Verify

After installation, ask Claude: “What StackHawk skills do you have?” It should describe the HawkScan scanning skill and API reporting skill.

Usage

Ask Claude to scan your application:

Scan my app running on localhost:8080 for security vulnerabilities

Claude will generate a stackhawk.yml config if one doesn’t exist, validate it, run the scan, and present findings. When you finish building a feature, Claude automatically runs a security scan, fixes any findings, and rescans to verify.

Tips

• The agent checks if your app is running and will prompt you to start it if needed
• For authenticated endpoints, tell Claude your auth pattern (e.g., “my app uses JWT bearer tokens”) and it will configure the scan accordingly
• Use hawk validate config stackhawk.yml to debug config issues
• The --json-output flag is used automatically for structured findings parsing