Skip to main content
Glama
TheoryofShadows

@mcpx-digital/openapi-summarize

@mcpx-digital/openapi-summarize

MCP server for local OpenAPI / Swagger analysis.

Load a local OpenAPI 3 or Swagger 2 JSON/YAML file, summarize endpoints by tag, find operations missing auth, list deprecated ops, and generate a short agent-friendly API cheat sheet.

Local files only. This server never fetches remote specs or credentials. Point tools at files you already have on disk.

Install

npx -y @mcpx-digital/openapi-summarize

Publish note: Prepared for npm as @mcpx-digital/openapi-summarize. Until published, run from a local clone or GitHub.

Related MCP server: swagger-api-mcp-server

Cursor mcp.json example

{
  "mcpServers": {
    "openapi-summarize": {
      "command": "npx",
      "args": ["-y", "@mcpx-digital/openapi-summarize"]
    }
  }
}

Local clone:

{
  "mcpServers": {
    "openapi-summarize": {
      "command": "node",
      "args": ["/absolute/path/to/openapi-summarize-mcp/index.js"]
    }
  }
}

Tools

Tool

What it does

summarize_by_tag

Group endpoints by OpenAPI tag

find_missing_auth

List ops with no security (heuristic)

list_deprecated

List deprecated: true operations

generate_cheat_sheet

Short markdown cheat sheet for agents

Example prompts

  • “Summarize ./openapi.yaml by tag”

  • “Which paths in petstore.json are missing auth?”

  • “Generate an API cheat sheet from api.json

Development

git clone https://github.com/TheoryofShadows/openapi-summarize-mcp.git
cd openapi-summarize-mcp
npm install
npm test

License

MIT

Available Tools

4 tools
find_missing_authA

Find operations missing security/auth requirements in a local OpenAPI file. Reads a local OpenAPI/Swagger JSON or YAML file path only — does not fetch remote specs.

ParametersJSON Schema
NameRequiredDescriptionDefault
filePathYesPath to OpenAPI JSON/YAML.

TDQS

A3.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations present, the description carries the full burden, and it usefully discloses a key behavioral constraint: it reads a local path only and will not fetch remote specs. That prevents an agent from passing a URL. It still doesn't clarify what counts as 'missing' auth or how results are returned, so it isn't complete.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tight sentences with the core purpose front-loaded and the local-file constraint immediately following. No filler, no restatement of the name.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple read-only, single-parameter analysis tool with no output schema, the description covers what the tool does and its main input constraint. Given the absent output schema, a brief note on the shape of results would help, but it is close to complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There is a single parameter with 100% schema description coverage ('Path to OpenAPI JSON/YAML'), so the schema already documents it fully. The description adds no format or syntax detail beyond the schema, which matches the baseline 3 for high coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource: 'Find operations missing security/auth requirements in a local OpenAPI file.' The purpose is unambiguous and clearly distinct from sibling analysis tools like summarize_by_tag and list_deprecated. It stops short of explicitly naming those siblings, so it lands at 4 rather than 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied by the name and description, and the 'local file path only' constraint narrows the intended scenario. However, it never states when to choose this over siblings or what prerequisites (e.g., a valid spec) are needed, leaving the agent to infer the context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

generate_cheat_sheetA

Generate a short agent-friendly markdown API cheat sheet from a local OpenAPI file. Reads a local OpenAPI/Swagger JSON or YAML file path only — does not fetch remote specs.

ParametersJSON Schema
NameRequiredDescriptionDefault
maxOpsNoMax operations to include (default 80, max 500).
filePathYesPath to OpenAPI JSON/YAML.

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It usefully discloses that only local JSON/YAML files are read and no network fetch occurs, but says nothing about what happens on an unreadable or malformed spec, whether output is written to disk or returned inline, or any truncation behavior tied to maxOps.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tight sentences, front-loaded with the purpose and followed by the single most important constraint. No filler or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple two-parameter read tool with no annotations and no output schema, the description covers what the tool produces (markdown cheat sheet) and its input constraint. It could say a bit more about output shape or failure modes, but nothing essential to invoking it is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so both filePath and maxOps are already documented with defaults and limits. The description reinforces that filePath must be local (not a URL), which adds slight value, but contributes nothing about maxOps beyond the schema. Baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (generate) and a concrete artifact (a short agent-friendly markdown API cheat sheet) derived from a local OpenAPI file. The scope is unambiguous, though it never contrasts itself with siblings like summarize_by_tag or find_missing_auth, so an agent must infer the distinction from the resource alone.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives one clear boundary — local file paths only, remote specs are not fetched — which functions as a 'when-not'. However, it never says when to choose this over summarize_by_tag/find_missing_auth/list_deprecated, and gives no prerequisites such as valid spec format or file accessibility.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_deprecatedA

List deprecated operations in a local OpenAPI file. Reads a local OpenAPI/Swagger JSON or YAML file path only — does not fetch remote specs.

ParametersJSON Schema
NameRequiredDescriptionDefault
filePathYesPath to OpenAPI JSON/YAML.

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden. It does disclose the local-only constraint and the accepted input formats, and 'List' implies a non-mutating read, but it says nothing about permissions, error behavior on malformed specs, or result shape.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, zero padding, with the core action and the most important constraint front-loaded in that order.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter, read-only listing tool with no output schema and no nested objects, the description covers the action and the input constraint adequately. A brief note on what a 'deprecated operation' result looks like would make it fully self-contained.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There is a single parameter at 100% schema description coverage, so the baseline is 3. The description restates that only a local file path is accepted (JSON or YAML), which adds the local-only nuance but little beyond what the schema already documents.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource: it lists deprecated operations from an OpenAPI file. The scope is unambiguous, but it does not distinguish itself from the sibling tools (summarize_by_tag, find_missing_auth, generate_cheat_sheet), which appear to operate on the same kind of input.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description sets a clear boundary — local file path only, no remote fetch — which implicitly tells the agent when this tool applies. However, it never contrasts itself with alternatives or states when a sibling tool would be the better choice.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

summarize_by_tagA

Load a local OpenAPI/Swagger file and summarize endpoints grouped by tag. Reads a local OpenAPI/Swagger JSON or YAML file path only — does not fetch remote specs.

ParametersJSON Schema
NameRequiredDescriptionDefault
filePathYesAbsolute or relative path to OpenAPI JSON/YAML.

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden, and it does disclose the key behavioral constraint that it reads local files only and performs no remote fetch. It is silent on error behavior (e.g., missing or malformed file) and does not state the read-only nature explicitly, though 'Load/Reads' implies it.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two front-loaded sentences that state the action first and the scope constraint second. There is mild redundancy, as the local-file-only idea is repeated in the second sentence, but overall it is tight and wastes little.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple single-parameter, annotation-free, output-schema-free tool, the description covers what it does, the accepted input type, and the local-only scope. It is nearly complete, lacking only minor detail such as what happens with an invalid path or how tags with no endpoints are handled.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and there is a single parameter, so the baseline is 3. The description reinforces that the value is a local JSON/YAML path ('path only'), but adds no syntax, format, or validation detail beyond what the schema already states.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description pairs a specific verb ('Load', 'summarize') with a precise resource ('endpoints grouped by tag' from an OpenAPI/Swagger file), so an agent immediately understands the output shape. It also scopes the input to local files, which distinguishes it from any remote-fetching behavior. It does not explicitly contrast itself with the siblings (find_missing_auth, list_deprecated, generate_cheat_sheet), which keeps it just short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The clause 'does not fetch remote specs' serves as an implicit when-not condition, telling the agent this tool is only for local file paths. However, there is no explicit guidance on when to choose this over generate_cheat_sheet or the other sibling analysis tools, so usage is only inferred.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 4 tool updatesv0.1.0
    • First observedfind_missing_auth
    • First observedgenerate_cheat_sheet
    • First observedlist_deprecated
    • First observedsummarize_by_tag

TDQS

A3.9/5.0

Scored across 4 tools

Disambiguation4/5

Each tool has a distinct OpenAPI analysis purpose, but summarize_by_tag and generate_cheat_sheet both produce summary-style output and could be confused by an agent at a glance. The specific focus on tags versus a compact cheat sheet helps separate them.

Naming Consistency5/5

All tool names use consistent snake_case with a verb-led pattern: summarize_by_tag, find_missing_auth, list_deprecated, generate_cheat_sheet. The convention is predictable and readable.

Tool Count5/5

Four tools is well-scoped for a focused OpenAPI summarization/analysis server, and each tool contributes a distinct capability without bloat.

Completeness4/5

The surface covers the main summarization and audit tasks: grouping by tag, finding missing auth, listing deprecated operations, and generating a cheat sheet. Minor gaps exist, such as listing all endpoints or searching operations, but core workflows are supported.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers