Wireproof

Loud bugs fail. Silent ones ship. We catch those.

Your coding agent gets sourced facts about how Stripe, Gusto, Plaid and seven more APIs behave, with the riskiest re-tested on the real APIs every night, and a check that points at the line in its code they would break.

Request access See what tests miss

It's an MCP server, the standard way coding agents such as Claude Code and Cursor call tools, so your agent looks things up while it works. It runs on your machine, so your code never leaves it. Security and data

› GET /v1/customers?limit=1000stripe sandbox
← 200 · 100 customers · has_more: true
· asked for 1000, got 100, no error
· export code: fewer than asked, so done
✗ every customer after the 100th missing
$ wireproof check .
export.ts:3 warning stripe-limit-over-100
Stripe returns at most 100, with no error.
Fix: page while has_more is true.
$
Wireproof today
  • 10APIs covered
  • 267sourced facts about how they behave
  • 58re-tested on the real API every night
  • 0guesses: if the docs don't say, we say so

Mistakes your tests won't catch.

Each one passes when you test it, then breaks with real users. Most are re-tested on the real API every night; your agent gets them from Wireproof before it writes the code.

Verified in sandboxLast checked
Stripe · webhooks

Webhooks ignore the API version you request

You sendStripe-Version: 2024-06-20 on the request that creates a customer.
Event hasapi_version 2017-12-14, the account's default, with that older shape.

Handlers parse a shape you never tested. Source

Verified in sandboxLast checked
· login token

A used login token works one more time

Docs sayEach refresh token works only once.
ActuallyA used token was accepted again and handed out new ones.

Two servers refreshing both get new tokens. Source

Verified in sandboxLast checked
Plaid · rate limits

The sandbox doesn't enforce the real limits

Docs sayBalance checks are limited to 5 per minute.
ActuallyThe sandbox allowed 12 in a row.

Rate-limit bugs only show up in production. Source

Verified in sandboxLast checked
Wise · webhooks

A slow webhook reply counts as a failure

Docs sayReply within 5 seconds.
ActuallyA reply after 7 seconds was refused, even though it said 200 OK.

Slow handlers get the same event repeatedly. Source

Verified in sandboxLast checked
HubSpot · rate limits

A rate-limited request doesn't say when to retry

Docs sayRate-limit headers report your limits. Retry-After isn't mentioned.
ActuallyNone of 55 rate-limited responses carried a Retry-After header.

Code that waits for Retry-After never waits. Source

Docs disagreeDocs read
BambooHR · rate limits

Rate limits switched from 503 to 429

Old docsRate limiting returns 503. A 429 means the employee limit was reached.
New docsSince 16 Sep 2026, rate limiting returns 429, always with Retry-After.

Retrying only on 503 now just fails. Source

Does it help? We tested it.

We gave AI coding agents the same work twice: once without Wireproof, once with it. Claude Opus 5.5 unless noted. Our own tests, so a sign, not proof.

Become a design partner.

We're working with three to five teams that build HR, payroll or fintech integrations with coding agents. It's free, and there's no sales pitch.

  • A 30-minute call where we run Wireproof on one of your repos, with you.
  • A few weeks of normal use with your coding agent.
  • Telling us when a fact or finding is wrong, confusing or missing.

Got a message from us? Reply to it. That's the fastest way in.

Once you have a key
Claude Code
claude mcp add wireproof -e WIREPROOF_API_KEY=YOUR_KEY -- npx -y wireproof mcp

Runs on your machine: the facts download once with your key, and code you check never leaves it. What we see, and what we don't

Request access

Goes only to the Wireproof team. We'll reply by email.

Which APIs do you integrate with?

Takes a minute. No mailing list.

Thanks, we've got it.

We'll reply to your email soon.