Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@@mhdd_24/api-auth-mcp Probe https://api.example.com/users with and without Authorization header"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Test API authentication and authorization.
Same architecture as @mhdd_24/sublime-mcp.
Full documentation: docs/WIKI.md
You (chat) → MCP client → api-auth-mcp → API Auth APIs / CLIs / local toolsRelated MCP server: TalkAPI
Requirement | Notes |
Node.js 18+ | ESM TypeScript MCP server |
Credentials / CLIs | See environment variables below |
npm install -g @mhdd_24/api-auth-mcpnpx @mhdd_24/api-auth-mcpgit clone https://github.com/Mhdd-24/API-Auth-MCP.git
cd API-Auth-MCP
npm install
npm run build
node dist/index.jsEdit ~/.cursor/mcp.json:
{
"mcpServers": {
"apiauth": {
"command": "npx",
"args": ["-y", "@mhdd_24/api-auth-mcp"],
"env": {
"API_AUTH_TOKEN": "..."
}
}
}
}Local development:
{
"command": "node",
"args": ["/absolute/path/to/API-Auth-MCP/dist/index.js"]
}Variable | Description |
| Optional bearer token |
Tool | Description |
| Show API auth test configuration. |
| Call URL with/without Authorization header. |
| Suggest auth test matrix for roles. |
ISC
Suggest auth test matrix for roles.
| Name | Required | Description | Default |
|---|---|---|---|
| roles | Yes | Comma-separated roles | |
| endpoint | Yes | Endpoint |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden of disclosing behavior. 'Suggest' implies an informational, non-mutating operation, but the description does not explain what the matrix contains, whether it performs any checks, what inputs drive it, or what the agent should expect in return.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, short sentence with no filler or redundant explanation. It is front-loaded with the action and deliverable, making it easy to scan, though it may be too sparse to provide full value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple two-parameter tool with fully documented schema properties, this is minimally viable. However, with no output schema and no annotations, the description should explain more about the nature of the 'auth test matrix' and how the endpoint is used, leaving some ambiguity for the agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3 even though the description itself adds little parameter-level detail. The description mentions roles but does not clarify how the endpoint parameter factors into the suggested matrix, so it adds limited meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action ('Suggest') and a clear deliverable ('auth test matrix for roles'). It is not a tautology and conveys the tool's core purpose, though it does not explicitly differentiate from the sibling tools apiauth_status and apiauth_probe.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided about when to use this tool versus apiauth_status or apiauth_probe. There is no mention of scenarios, exclusions, or alternatives, leaving the agent to infer suitable usage from the tool name alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Call URL with/without Authorization header.
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | URL | |
| token | No | Bearer token |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses that an HTTP call is made and that the Authorization header can be omitted, but it does not disclose the HTTP method, whether this is read-only or has side effects, or how responses are returned.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, front-loaded with the core action, no filler. It is appropriately sized for a simple tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no annotations and no output schema, the description leaves the agent guessing about what a probe returns (e.g., status code, headers, or body) and what the operational impact is. For a network-calling tool this is a notable gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema descriptions already cover both params (URL and Bearer token) at 100%, so the baseline is 3. The description adds the relationship between the token parameter and the Authorization header, which is helpful but not extensive.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States the verb 'Call' and the resource 'URL', and specifies the key variant: with or without Authorization header. It is a clear action, though it does not explicitly distinguish itself from apiauth_status or apiauth_matrix.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'with/without Authorization header' implies a comparison use case for testing auth-required endpoints. However, there is no explicit statement of when to choose apiauth_probe over the siblings apiauth_status or apiauth_matrix.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Show API auth test configuration.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must disclose behavioral traits. The verb 'Show' implies a read-only operation, but it does not explicitly state side effects, permissions, or data sources. For a zero-parameter status tool this is adequate but not rich.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, concise sentence with no filler. It is appropriately sized for a simple tool with no parameters and no output schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description is minimal and adequate for a zero-parameter tool, but it does not clarify what 'configuration' entails or how it relates to the sibling tools. An agent might need additional context to decide when to call this versus apiauth_probe or apiauth_matrix.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the schema trivially covers all inputs. Per the baseline rule for zero parameters, a score of 4 is appropriate since there is nothing to explain.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Show') and resource ('API auth test configuration'), making the purpose clear. However, it does not explicitly differentiate from sibling tools like apiauth_probe or apiauth_matrix, which could have overlapping purposes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus the siblings. There is no mention of alternatives, exclusions, or conditions that would select this tool over apiauth_probe or apiauth_matrix.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
v1.0.0apiauth_matrixapiauth_probeapiauth_statusScored across 3 tools
Each tool has a distinct role: status shows the current auth configuration, probe actually executes a request, and matrix suggests test scenarios. There is minor potential confusion between status and matrix, but the descriptions separate present-state reporting from future/test-plan generation well enough.
All tool names follow a consistent apiauth_ prefix and lowercase snake_case style. Although the names are not strictly verb_noun, the pattern is uniform and predictable across the entire set.
Three tools is well-scoped for the narrow purpose of API auth testing. Each tool covers a meaningful and distinct aspect without unnecessary redundancy.
The set covers inspecting configuration, executing probes, and generating a test matrix, which forms a coherent workflow. A minor gap is the lack of a tool for updating or persisting auth configuration, but the current surface is sufficient for advisory and testing tasks.
End-to-end API testing — generate and run tests from OpenAPI, curl, Postman, or real user traffic.
AI-callable tools for API mocking, testing, monitoring, security, and automation.
AI pentesting: run scans, triage vulnerabilities, review PRs, manage schedules and assets.
Point Gecko at an OpenAPI spec; get first-call-correct, auth-hidden agent tools.
