42Crunch
London API security platform that audits OpenAPI contracts, scans live APIs against them and turns the approved contract into a gateway firewall policy
Quick Overview
| Company | 42Crunch Ltd |
|---|---|
| Category | API Security Platforms |
| Headquarters | London, United Kingdom |
| Founded | Not stated |
| EU Presence | Yes - United Kingdom |
| Data Location | Not stated on the pages checked |
| Open Source | No |
| GDPR Compliant | Yes |
| Self-Hosting | Cloud, on-premise or hybrid deployment, per its pricing page |
| Main Features | OpenAPI contract audit, dynamic API scan, runtime micro-firewall, API discovery, GraphQL security, MCP server security, CI/CD quality gates |
| Pricing | Enterprise pricing on request; 14-day free trial of the AI coding plugin |
| Best For | Teams that already write OpenAPI definitions and want the same file to drive testing and enforcement |
| Replaces | Traceable, Salt Security, Noname Security |
Detailed Review
42Crunch treats the API specification as the source of truth. The file your developers already write is scored for weaknesses, used to drive a live scan and finally loaded as an allowlist in front of the running service.
The company is a UK limited company with its parent at an address in Covent Garden, London, according to its privacy policy. Its site now puts MCP server governance first, with API security kept as a separate, fully described product line.
Four steps from one file
The vendor describes a cycle of contract, audit, scan and protect. The audit stage runs more than 300 static checks on the definition for issues such as broken authentication, data exposure and injection risk, with scores shown in the editor and in CI/CD.
The scan stage then sends simulated traffic to the running API and checks it behaves as the contract says, with results mapped to the OWASP API Security Top 10.
A positive security model at the gateway
For runtime, 42Crunch deploys a micro-firewall from the pipeline and rebuilds it when the contract changes. Requests with the wrong verb, path, content type or payload shape are rejected, and rate limits can be set per client and per operation.
This is a different idea from learning normal behaviour out of traffic: protection is only as good as the contract, which makes spec hygiene part of your security work.
Where the focus has moved
The homepage now leads with discovery and governance of MCP servers for AI agents, mapped to the EU AI Act and other frameworks. The classic API product is still documented, but a buyer who wants only API testing should confirm the roadmap in a demo.
Limitations to Consider
The model depends on accurate OpenAPI or GraphQL definitions, so APIs without specifications get less from it. Pricing is not published beyond a trial, and the vendor's current messaging centres on MCP security. For a tool that finds business-logic flaws by attacking the live service, compare Equixly or Escape.
Who Should Use 42Crunch
Engineering and platform teams with spec-first APIs who want testing in the IDE and pipeline, and an enforcement layer built from the same definition.
Pros and Cons
Pros
- Audit, scan and protection share one contract
- Static checks run in the IDE and in CI/CD
- Runtime policy regenerates when the contract changes
- Covers GraphQL as well as REST
- ISO 27001 certified according to its trust page
Cons
- Weaker value for APIs without maintained specifications
- No public price list for the platform
- Current homepage emphasis is on MCP governance
- Hosting region not stated on the pages checked
Alternatives to 42Crunch
Other European api security platforms worth comparing before you decide:
Equixly
Italy · Agentic AI penetration testing aimed at API business logic
Escape
France · Business-logic DAST for REST and GraphQL APIs from Paris
AppCheck
United Kingdom · Scanner with API-specific fuzzing, request signing and OAuth support
Aikido Security
Belgium · Developer security suite with an API scanner and shadow API discovery
See all European api security platforms or compare them directly against Traceable on our alternatives page.
Frequently Asked Questions
Yes, the audit and the firewall policy are built from the definition. The platform can also create a contract from code or traffic, according to its OpenAPI contract page.
The vendor offers a 14-day trial of its AI coding plugin with a work email and no credit card. Platform pricing is scoped per organisation.
No. The vendor lists a GraphQL security product that applies the same audit, scan and protect cycle to schemas.