Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

your project Route Tester Skill · microck | DecimalAI

microck/route-tester

SkillScore64Maintained

Test authenticated routes in the your project using cookie-based authentication. Use this skill when testing API endpoints, validating route functionality, or debugging authentication issues. Includes patterns for using test-auth-route.js and mock authentication.

Testingby microck

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

QA & Test Engineering pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/microck-route-tester/SKILL.md

decimalai skills pull microck-route-tester --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/microck-route-tester/SKILL.md https://app.decimal.ai/s/microck-route-tester/SKILL.md

Raw file: /s/microck-route-tester/SKILL.md ↗ · machine-readable summary at /s/microck-route-tester.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

22 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 8d ago

Yes — +50% lift · at higher cost+114% tokens0% turns64% of whole cases pass with skill (14/22)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-01	✗→✓	▲ Improved	92%	0%
case-02	✗→✓	▲ Improved	76%	0%
case-03	✗→✓	▲ Improved	155%	0%
case-04	✗→✓	▲ Improved	68%	0%
case-05	✗→✓	▲ Improved	100%	0%

Showing 5 of 22 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/3/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

microck / ordinary-claude-skills

skills_all/route-tester/SKILL.md

View on GitHub ↗

License NOASSERTIONImported 8/3/2026Version v1

Skill contents

SKILL.md

your project Route Tester Skill

Purpose

This skill provides patterns for testing authenticated routes in the your project using cookie-based JWT authentication.

When to Use This Skill

Testing new API endpoints
Validating route functionality after changes
Debugging authentication issues
Testing POST/PUT/DELETE operations
Verifying request/response data

your project Authentication Overview

The your project uses:

Keycloak for SSO (realm: yourRealm)
Cookie-based JWT tokens (not Bearer headers)
Cookie name: refresh_token
JWT signing: Using secret from config.ini

Testing Methods

Method 1: test-auth-route.js (RECOMMENDED)

The test-auth-route.js script handles all authentication complexity automatically.

Location: /root/git/your project_pre/scripts/test-auth-route.js

Basic GET Request

bash
node scripts/test-auth-route.js http://localhost:3000/blog-api/api/endpoint

POST Request with JSON Data

bash
node scripts/test-auth-route.js \
    http://localhost:3000/blog-api/777/submit \
    POST \
    '{"responses":{"4577":"13295"},"submissionID":5,"stepInstanceId":"11"}'

What the Script Does

Gets a refresh token from Keycloak

Username: testuser
Password: testpassword

Signs the token with JWT secret from config.ini
Creates cookie header: refresh_token=<signed-token>
Makes the authenticated request
Shows the exact curl command to reproduce manually

Script Output

The script outputs:

The request details
The response status and body
A curl command for manual reproduction

Note: The script is verbose - look for the actual response in the output.

Method 2: Manual curl with Token

Use the curl command from the test-auth-route.js output:

bash
# The script outputs something like:
# 💡 To test manually with curl:
# curl -b "refresh_token=eyJhbGci..." http://localhost:3000/blog-api/api/endpoint

# Copy and modify that curl command:
curl -X POST http://localhost:3000/blog-api/777/submit \
  -H "Content-Type: application/json" \
  -b "refresh_token=<COPY_TOKEN_FROM_SCRIPT_OUTPUT>" \
  -d '{"your": "data"}'

Method 3: Mock Authentication (Development Only - EASIEST)

For development, bypass Keycloak entirely using mock auth.

Setup

bash
# Add to service .env file (e.g., blog-api/.env)
MOCK_AUTH=true
MOCK_USER_ID=test-user
MOCK_USER_ROLES=admin,operations

Usage

bash
curl -H "X-Mock-Auth: true" \
     -H "X-Mock-User: test-user" \
     -H "X-Mock-Roles: admin,operations" \
     http://localhost:3002/api/protected

Mock Auth Requirements

Mock auth ONLY works when:

NODE_ENV is development or test
The mockAuth middleware is added to the route
Will NEVER work in production (security feature)

Common Testing Patterns

Test Form Submission

bash
node scripts/test-auth-route.js \
    http://localhost:3000/blog-api/777/submit \
    POST \
    '{"responses":{"4577":"13295"},"submissionID":5,"stepInstanceId":"11"}'

Test Workflow Start

bash
node scripts/test-auth-route.js \
    http://localhost:3002/api/workflow/start \
    POST \
    '{"workflowCode":"DHS_CLOSEOUT","entityType":"Submission","entityID":123}'

Test Workflow Step Completion

bash
node scripts/test-auth-route.js \
    http://localhost:3002/api/workflow/step/complete \
    POST \
    '{"stepInstanceID":789,"answers":{"decision":"approved","comments":"Looks good"}}'

Test GET with Query Parameters

bash
node scripts/test-auth-route.js \
    "http://localhost:3002/api/workflows?status=active&limit=10"

Test File Upload

bash
# Get token from test-auth-route.js first, then:
curl -X POST http://localhost:5000/upload \
  -H "Content-Type: multipart/form-data" \
  -b "refresh_token=<TOKEN>" \
  -F "file=@/path/to/file.pdf" \
  -F "metadata={\"description\":\"Test file\"}"

Hardcoded Test Credentials

The test-auth-route.js script uses these credentials:

Username: testuser
Password: testpassword
Keycloak URL: From config.ini (usually http://localhost:8081)
Realm: yourRealm
Client ID: From config.ini

Service Ports

| Service | Port | Base URL | |---------|------|----------| | Users | 3000 | http://localhost:3000 | | Projects| 3001 | http://localhost:3001 | | Form | 3002 | http://localhost:3002 | | Email | 3003 | http://localhost:3003 | | Uploads | 5000 | http://localhost:5000 |

Route Prefixes

Check /src/app.ts in each service for route prefixes:

typescript
// Example from blog-api/src/app.ts
app.use('/blog-api/api', formRoutes);          // Prefix: /blog-api/api
app.use('/api/workflow', workflowRoutes);  // Prefix: /api/workflow

Full Route = Base URL + Prefix + Route Path

Example:

Base: http://localhost:3002
Prefix: /form
Route: /777/submit
Full URL: http://localhost:3000/blog-api/777/submit

Testing Checklist

Before testing a route:

] Identify the service (form, email, users, etc.)
] Find the correct port
] Check route prefixes in app.ts
] Construct the full URL
] Prepare request body (if POST/PUT)
] Determine authentication method
] Run the test
] Verify response status and data
] Check database changes if applicable

Verifying Database Changes

After testing routes that modify data:

bash
# Connect to MySQL
docker exec -i local-mysql mysql -u root -ppassword1 blog_dev

# Check specific table
mysql> SELECT * FROM WorkflowInstance WHERE id = 123;
mysql> SELECT * FROM WorkflowStepInstance WHERE instanceId = 123;
mysql> SELECT * FROM WorkflowNotification WHERE recipientUserId = 'user-123';

Debugging Failed Tests

401 Unauthorized

Possible causes:

Token expired (regenerate with test-auth-route.js)
Incorrect cookie format
JWT secret mismatch
Keycloak not running

Solutions:

bash
# Check Keycloak is running
docker ps | grep keycloak

# Regenerate token
node scripts/test-auth-route.js http://localhost:3002/api/health

# Verify config.ini has correct jwtSecret

403 Forbidden

Possible causes:

User lacks required role
Resource permissions incorrect
Route requires specific permissions

Solutions:

bash
# Use mock auth with admin role
curl -H "X-Mock-Auth: true" \
     -H "X-Mock-User: test-admin" \
     -H "X-Mock-Roles: admin" \
     http://localhost:3002/api/protected

404 Not Found

Possible causes:

Incorrect URL
Missing route prefix
Route not registered

Solutions:

Check app.ts for route prefixes
Verify route registration
Check service is running (pm2 list)

500 Internal Server Error

Possible causes:

Database connection issue
Missing required fields
Validation error
Application error

Solutions:

Check service logs (pm2 logs <service>)
Check Sentry for error details
Verify request body matches expected schema
Check database connectivity

Using auth-route-tester Agent

For comprehensive route testing after making changes:

Identify affected routes
Gather route information:

Full route path (with prefix)
Expected POST data
Tables to verify

Invoke auth-route-tester agent

The agent will:

Test the route with proper authentication
Verify database changes
Check response format
Report any issues

Example Test Scenarios

After Creating a New Route

bash
# 1. Test with valid data
node scripts/test-auth-route.js \
    http://localhost:3002/api/my-new-route \
    POST \
    '{"field1":"value1","field2":"value2"}'

# 2. Verify database
docker exec -i local-mysql mysql -u root -ppassword1 blog_dev \
    -e "SELECT * FROM MyTable ORDER BY createdAt DESC LIMIT 1;"

# 3. Test with invalid data
node scripts/test-auth-route.js \
    http://localhost:3002/api/my-new-route \
    POST \
    '{"field1":"invalid"}'

# 4. Test without authentication
curl http://localhost:3002/api/my-new-route
# Should return 401

After Modifying a Route

bash
# 1. Test existing functionality still works
node scripts/test-auth-route.js \
    http://localhost:3002/api/existing-route \
    POST \
    '{"existing":"data"}'

# 2. Test new functionality
node scripts/test-auth-route.js \
    http://localhost:3002/api/existing-route \
    POST \
    '{"new":"field","existing":"data"}'

# 3. Verify backward compatibility
# Test with old request format (if applicable)

Configuration Files

config.ini (each service)

ini
[keycloak]
url = http://localhost:8081
realm = yourRealm
clientId = app-client

[jwt]
jwtSecret = your-jwt-secret-here

.env (each service)

bash
NODE_ENV=development
MOCK_AUTH=true           # Optional: Enable mock auth
MOCK_USER_ID=test-user   # Optional: Default mock user
MOCK_USER_ROLES=admin    # Optional: Default mock roles

Key Files

/root/git/your project_pre/scripts/test-auth-route.js - Main testing script
/blog-api/src/app.ts - Form service routes
/notifications/src/app.ts - Email service routes
/auth/src/app.ts - Users service routes
/config.ini - Service configuration
/.env - Environment variables

Related Skills

Use database-verification to verify database changes
Use error-tracking to check for captured errors
Use workflow-builder for workflow route testing
Use notification-sender to verify notifications sent

Want to see if microck/route-tester would activate on your phrasing? Try it before you install — no LLM call, no signup.

Latest benchmark · publisher runVerified

8/21/2026, 04:55 UTC · 22 cases

Lift

+50%

64% vs 14%

Agent turns

1.0 vs 1.0

Tokens

+114%

3,738.64 vs 1,750.27

fail → pass · 12pass → pass · 2fail → fail · 7pass → fail · 1

Per-case results (22)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-01 I just added a new submission endpoint to our form service and need to verify it locally with authenticated request payloads. Please give me the exact command to test this endpoint using our project's helper tools, along with a structured checklist detailing how to inspect the response status and verify the resulting database state.	fail→pass	12,666	7,489	-41%	1	1	0%	2,252	4,325	+92%	0	0	—
case-02 My API call to a protected workflow route is returning a 401 Unauthorized error during local integration testing. Please generate a targeted troubleshooting breakdown listing the primary causes for this status in our authentication setup, action steps to resolve the issue, and alternative bypass strategies for local development.	fail→pass	15,990	11,061	-31%	1	1	0%	2,782	4,893	+76%	0	0	—
case-03 I need to test an authenticated file upload endpoint in our application using multipart form data. Please provide a clear, step-by-step set of shell commands showing how to obtain a valid auth token from our local environment and pass it into a curl request along with a file payload.	fail→pass	8,937	7,274	-19%	1	1	0%	1,665	4,245	+155%	0	0	—
case-04 I want to enable mock authentication locally for the form service without logging into Keycloak. I usually set NODE_ENV=production for realistic testing and pass MOCK_AUTH=1. What exact environment variable names and runtime conditions are required for mock auth to work?	fail→pass	13,142	4,779	-64%	1	1	0%	2,229	3,748	+68%	0	0	—
case-05 I'm sending a test request directly to our mock-authenticated local form service on port 3002. I plan to use standard OAuth headers like X-User-ID and Authorization: Bearer mock. What exact HTTP headers should I send with curl to pass user identity and roles?	fail→pass	10,839	3,897	-64%	1	1	0%	1,802	3,607	+100%	0	0	—
case-06 After submitting a workflow completion request, I need to check the database state. Should I run npm run db:verify or execute a direct SQL query against our local MySQL docker container? What is the database name and exact docker command?	fail→pass	8,656	3,384	-61%	1	1	0%	1,408	3,472	+147%	0	0	—
case-07 I need to test fetching active workflows with query parameters like status=active&limit=10 on our Form service (port 3002). I usually construct a custom axios script in Node. How should I invoke our route testing helper for this GET request?	fail→pass	7,079	4,144	-41%	1	1	0%	1,235	3,625	+194%	0	0	—
case-08 I need to send a POST request to complete step 789 on an active workflow instance via port 3002. The endpoint is /api/workflow/step/complete. How should I invoke the auth testing script to pass the JSON body with stepInstanceID and answers?	fail→pass	9,221	3,417	-63%	1	1	0%	1,780	3,507	+97%	0	0	—
case-09 I am trying to send a request to the Form microservice locally, but I am confused whether it runs on port 3000, 3001, or 3002. Which port maps to Form vs Users?	fail→pass	8,598	3,270	-62%	1	1	0%	1,564	3,524	+125%	0	0	—
case-10 I'm setting up local curl requests for file attachments and email notifications. What are the designated local ports for the Uploads service versus the Email service?	fail→pass	9,991	2,615	-74%	1	1	0%	1,692	3,338	+97%	0	0	—
case-11 When test-auth-route.js requests a refresh token from Keycloak under realm yourRealm, what default username and password credentials does it supply?	fail→fail	11,166	1,628	-85%	1	1	0%	1,928	3,054	+58%	0	0	—
case-12 Where does test-auth-route.js look to retrieve the JWT secret and Keycloak realm configuration when signing tokens locally?	fail→fail	10,474	3,090	-70%	1	1	0%	1,737	3,345	+93%	0	0	—
case-13 In blog-api/src/app.ts, if app.use('/blog-api/api', formRoutes) is declared, what is the full local URL to test the endpoint /777/submit on the Users service port (3000)?	fail→fail	2,391	3,026	+27%	1	1	0%	431	3,291	+664%	0	0	—
case-14 My authenticated request returned a 403 Forbidden status code when calling /api/protected on port 3002. How can I quickly test this endpoint using mock auth headers to grant the required admin role?	fail→fail	11,385	4,423	-61%	1	1	0%	1,987	3,638	+83%	0	0	—
case-15 I get a 404 Not Found response when calling a newly created endpoint on port 3002. What key file should I inspect in the microservice repository to check if the route prefix or middleware registration is missing?	fail→fail	9,222	2,792	-70%	1	1	0%	1,538	3,342	+117%	0	0	—
case-16 When testing a POST route, the response gives a 500 Internal Server Error. What process manager command should I run locally to view the microservice runtime logs?	fail→fail	6,517	2,920	-55%	1	1	0%	1,206	3,297	+173%	0	0	—
case-17 I need to test starting a workflow with code DHS_CLOSEOUT for entity Submission ID 123 on port 3002. Show me the command using our project's recommended auth test script.	fail→pass	7,433	2,696	-64%	1	1	0%	1,211	3,338	+176%	0	0	—
case-18 When passing JWT tokens in standard HTTP headers vs cookies in our project architecture, what exact cookie key name must be used in the Cookie header?	fail→fail	10,127	1,808	-82%	1	1	0%	1,729	3,144	+82%	0	0	—
case-19 I just added a new database-writing POST endpoint /api/my-new-route on port 3002. Outline the 4-step testing checklist from route invocation to security testing.	fail→pass	7,673	5,352	-30%	1	1	0%	1,315	3,801	+189%	0	0	—
case-20 I need to configure a brand new Keycloak realm named yourRealm on our local Docker Keycloak instance (port 8081). How do I create client scopes, set up client secrets, and export the realm JSON file from the Keycloak Admin Console?	pass→fail	11,914	9,023	-24%	1	1	0%	2,084	4,437	+113%	0	0	—
case-21 I am writing unit tests in Jest for my Express controller functions in blog-api/src/controllers/form.ts. How should I mock the database service and write assertions using supertest or Jest expect()?	pass→pass	27,011	12,142	-55%	1	1	0%	3,231	5,166	+60%	0	0	—
case-22 I need to add a new column status to the WorkflowInstance database table. What command should I run to create and apply a database migration script in our TypeScript project?	pass→pass	8,625	6,755	-22%	1	1	0%	1,700	4,113	+142%	0	0	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 22 cases were attempted. The headline lift of +50 percentage points is the difference between those two pass rates over the 22 comparable cases. 1 case got worse with the skill loaded, and it is included in that figure.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 13.6%
Pass rate with the skill: 63.6%
Cases attempted: 22
Cases counted toward lift: 22
Cases that regressed: 1
Skill version measured: v1
Run completed: 8/21/2026, 04:55 UTC

Measured example — same prompt, with vs. without the skill · from the benchmark run · case case-01

Prompt

I just added a new submission endpoint to our form service and need to verify it locally with authenticated request payloads. Please give me the exact command to test this endpoint using our project's helper tools, along with a structured checklist detailing how to inspect the response status and verify the resulting database state.

Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.

Show both answers

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run64

Live evalNeeds ≥20 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns+88% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 8 days ago

Other measured skills in the registry, with their headline benchmark lift.

Ready to supercharge your AI agents?

microck/route-tester

SkillSafety

Source

your project Route Tester Skill

Purpose

When to Use This Skill

your project Authentication Overview

Testing Methods

Method 1: test-auth-route.js (RECOMMENDED)

Basic GET Request

POST Request with JSON Data

What the Script Does

Script Output

Method 2: Manual curl with Token

Method 3: Mock Authentication (Development Only - EASIEST)

Setup

Usage

Mock Auth Requirements

Common Testing Patterns

Test Form Submission

Test Workflow Start

Test Workflow Step Completion

Test GET with Query Parameters

Test File Upload

Hardcoded Test Credentials

Service Ports

Route Prefixes

Testing Checklist

Verifying Database Changes

Debugging Failed Tests

401 Unauthorized

403 Forbidden

404 Not Found

500 Internal Server Error

Using auth-route-tester Agent

Example Test Scenarios

After Creating a New Route

After Modifying a Route

Configuration Files

config.ini (each service)

.env (each service)

Key Files

Related Skills

How this skill was measured

Measured example — same prompt, with vs. without the skill · from the benchmark run · case case-01

Related skills