Skip to main content
Glama

openapi_review

Read-onlyIdempotent

Heuristic review of an OpenAPI 3.x document (JSON): security, pagination, error responses, idempotency, versioning and documentation gaps. Not a linter replacement.

Input Schema

NameRequiredDescriptionDefault
documentYes

Output Schema

NameRequiredDescriptionDefault
kindNo
pathsNo
openapiNo
sourcesNo
summaryNo
findingsNo
validatedNo
limitationNo
operationsNo
limitationsNo
securitySchemesNo

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observed

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare the safe read-only, idempotent, closed-world profile, so the description only needs to add what they cannot. Calling the review 'heuristic' meaningfully signals that findings are judgment-based and non-exhaustive rather than a deterministic ruleset, and the enumerated check areas tell the agent what kind of findings to expect. Return shape is covered by the output schema, so nothing critical is missing.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, no filler, with the scope and the covered dimensions front-loaded and the disambiguation clause placed last where it reads as a caveat. Every phrase earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With one parameter, full annotation coverage and an output schema, the description gives the agent enough to call it correctly: what to pass and what the analysis covers. The only gap is that document size limits or handling of non-3.x specs is left implicit in '3.x' rather than stated.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must carry parameter meaning, and it does contribute the essential constraint: the input is an OpenAPI 3.x document in JSON form. It does not clarify whether the caller passes a parsed object versus a serialized string (the schema implies an object with arbitrary properties), nor whether Swagger 2.0 is rejected. Adequate compensation, but not full.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Heuristic review of an OpenAPI 3.x document (JSON)') and enumerates the exact dimensions checked: security, pagination, error responses, idempotency, versioning, documentation gaps. The closing clause distinguishes it from linters, so an agent can place it against the sibling *_review family without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The negative guidance is explicit ('Not a linter replacement'), which tells the agent when to prefer a spec-linter instead. However, there is no positive trigger — no statement of when an agent should reach for this over siblings like mcp_server_review or cloudformation_review, and no prerequisites such as document size or supported versions beyond '3.x'.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.