audit_openapi
Check OpenAPI or Swagger specs for API security flaws such as missing authentication, plaintext servers, and object ID enumeration. Outputs SECURE, REVIEW, or INSECURE verdict.
Instructions
Audit an OpenAPI/Swagger spec (URL to openapi.json or raw JSON) for API-security smells an agent won't catch reading prose: no security scheme, plaintext http servers, unauthenticated POST/PUT/DELETE, object-id endpoints with no auth (OWASP API1 BOLA/IDOR). Returns SECURE/REVIEW/INSECURE. deep=true lists the exact offending operations + fixes (premium).
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| target | Yes | A URL to an OpenAPI/Swagger spec, or the raw spec JSON. | |
| deep | No | When true, runs the PREMIUM tier. Requires an API key (set OPENAPI_DOCTOR_KEY in your MCP env); without one you'll get instructions to unlock it. The free verdict needs no key. |