audit_openapi_readinessStatically inspect an OpenAPI 3.0 or 3.1 JSON object or JSON string for operation identity, auth and scopes, errors, examples, retries, limits, lifecycle, pagination, and workflows. No API operation is executed.
| Name | Required | Description | Default |
|---|---|---|---|
| document | Yes | OpenAPI JSON object or a string containing JSON. YAML is reported as unsupported and unobservable. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the behavioral transparency burden. It usefully discloses that the tool is static and executes no API operations, and it narrows supported inputs to OpenAPI 3.0/3.1 JSON. However, it does not describe the output format, error handling, or any limits, so the behavioral picture is incomplete.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with no filler. The core behavior and scope are front-loaded, followed by the key safety guarantee that no API operation is executed. Every sentence contributes necessary information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter tool, the description gives a strong account of what the tool checks and what input it accepts. The absence of an output schema or return-value description is a minor gap, but the agent can still select and invoke the tool correctly from the provided information.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already provides 100% coverage for the single 'document' parameter, describing the accepted object/string forms and noting that YAML is unsupported. The description essentially restates this rather than adding new parameter semantics, so the baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description begins with the specific verb 'statically inspect' and names a precise resource: an OpenAPI 3.0 or 3.1 JSON object or JSON string. It also enumerates the audit dimensions (auth, errors, examples, retries, etc.), which makes the tool's scope unmistakable and clearly distinguishes it from the unrelated sibling tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'statically inspect' and 'No API operation is executed' clearly communicates that this is the tool to use when you need an analysis of an OpenAPI document without invoking any live endpoints. It does not explicitly state when to prefer a sibling, but the sibling tools are semantically distant enough that no exclusions are necessary.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Add one secure layer between your agents and this server.
Most tools target clearly distinct artifacts: OpenAPI, A2A cards, crawler access, saved reports, and fix verification. The main ambiguity is between scan_url and get_fix_pack, since both scan a public URL and return fix-pack-related output, though scan_url emphasizes the full score/findings while get_fix_pack focuses on prioritized fixes.
All tool names follow a consistent verb_noun snake_case pattern: audit_, check_, get_, scan_, validate_, verify_. The verbs are appropriate and the naming makes the intended action readable at a glance.
Seven tools is well-scoped for a URL and API readiness scanning server. Each tool addresses a distinct phase or artifact in the workflow: scanning, fix generation, fix verification, report retrieval, and specialized static audits.
The core lifecycle is covered: scan a URL, obtain fixes, verify fixes, and retrieve reports, plus specialized audits for OpenAPI, A2A, and crawler access. Minor gaps exist, such as no way to list or manage saved public reports and no explicit repository-connection tool, but these are workable.