SpecProof: Your OpenAPI spec, cross-checked against your tests

Your OpenAPI spec,
cross-checked against your tests.

SpecProof compares your OpenAPI spec with your test suite.
Every documented response gets a verdict, and every verdict links to the test behind it.

specproof 2026-07-30 17:38 UTC

Operations7 Status pairs verified11/24 Gaps13 Untested routes1 Responses verified46%

Verified No test Missing from spec Undocumented

Exchange credentials for a session token

200 Session token issued 1 assertion VERIFIED ⌕

401 Invalid credentials 1 assertion VERIFIED ⌕

500 MISSING FROM SPEC NO TEST

List tasks for the authenticated user

200 Task list 1 assertion VERIFIED ⌕

401 Missing or invalid bearer token 1 assertion VERIFIED ⌕

500 MISSING FROM SPEC NO TEST

Create a task

201 Task created 1 assertion VERIFIED ⌕

400 Malformed request body 1 assertion VERIFIED ⌕

401 Missing or invalid bearer token NO TEST

422 NO DESCRIPTION 1 assertion VERIFIED ⌕

500 MISSING FROM SPEC NO TEST

Fetch a single task

200 The task 2 assertions VERIFIED ⌕

404 No task with this id 1 assertion VERIFIED ⌕

500 MISSING FROM SPEC NO TEST

Update a task's fields

200 Updated task 2 assertions VERIFIED ⌕

404 No task with this id NO TEST

409 Task was modified concurrently NO TEST

500 MISSING FROM SPEC NO TEST

Delete a task

204 Task deleted NO TEST

404 No task with this id NO TEST

500 MISSING FROM SPEC 1 assertion UNDOCUMENTED ⌕

List projects

200 Project list NO TEST

401 Missing or invalid bearer token NO TEST

500 MISSING FROM SPEC NO TEST

How it works

Three steps, one committed JSON report.

Read

Finds your OpenAPI spec, scans your tests. No configuration.

openapi.yaml or openapi.json POST /tasks

201Task created

400Malformed body

401Missing bearer token

tasks.test.ts .tsx .js .jsx describe("POST /tasks")

201it("creates a task")

400it("requires a title")

422it("rejects a past date")

Compare

Matches every documented response to its assertions.

POST /tasks

201 Verified

400 Verified

401 No test

422 Undocumented

Guard

The report is one committed file. CI fails when it goes stale.

CI ci.yml

buildPassed

lintPassed

testPassed

specproofRunningStale

What it works with

The frameworks we support, and the syntax we read.

tests/tasks.test.ts Named imports from vitest.

import { describe, it, expect } from "vitest";

describe("POST /tasks", () => {Operation

it("creates a task", async () => {

expect(res.status).toBe(201);Response

});

tests/tasks.test.ts test() is read exactly like it().

import { describe, test, expect } from "bun:test";

describe("POST /tasks", () => {Operation

test("creates a task", async () => {

expect(res.status).toBe(201);Response

});

tests/tasks.test.js toEqual() is read exactly like toBe().

// describe, it and expect are globals

describe("POST /tasks", () => {Operation

it("creates a task", async () => {

expect(res.status).toEqual(201);Response

});

Get started

Install as a dev dependency and run it from your repo.

Install

$ bun add -d specproof

$ npm install -D specproof

$ pnpm add -D specproof

$ yarn add -D specproof

Run

$ bunx specproof dev

$ npx specproof dev

$ pnpm exec specproof dev

$ yarn specproof dev

Serves the report at localhost:3001.

On CI

Add .github/workflows/specproof.yml and commit the report next to your code.

name: specproof
on: [pull_request]

jobs:
  check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
      - run: npm install
      - run: npx specproof generate --out specproof.json --check

Prove your spec

One dev dependency, no configuration.

$ npm install -D specproof