@mcpx-digital/openapi-summarize
Provides tools for analyzing local OpenAPI/Swagger specifications, including summarizing endpoints by tag, finding operations missing auth, listing deprecated operations, and generating an agent-friendly API cheat sheet.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@@mcpx-digital/openapi-summarizesummarize the endpoints in ./openapi.yaml by tag"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
@mcpx-digital/openapi-summarize
MCP server for local OpenAPI / Swagger analysis.
Load a local OpenAPI 3 or Swagger 2 JSON/YAML file, summarize endpoints by tag, find operations missing auth, list deprecated ops, and generate a short agent-friendly API cheat sheet.
Local files only. This server never fetches remote specs or credentials. Point tools at files you already have on disk.
Install
npx -y @mcpx-digital/openapi-summarizePublish note: Prepared for npm as
@mcpx-digital/openapi-summarize. Until published, run from a local clone or GitHub.
Related MCP server: swagger-api-mcp-server
Cursor mcp.json example
{
"mcpServers": {
"openapi-summarize": {
"command": "npx",
"args": ["-y", "@mcpx-digital/openapi-summarize"]
}
}
}Local clone:
{
"mcpServers": {
"openapi-summarize": {
"command": "node",
"args": ["/absolute/path/to/openapi-summarize-mcp/index.js"]
}
}
}Tools
Tool | What it does |
| Group endpoints by OpenAPI tag |
| List ops with no security (heuristic) |
| List |
| Short markdown cheat sheet for agents |
Example prompts
“Summarize
./openapi.yamlby tag”“Which paths in
petstore.jsonare missing auth?”“Generate an API cheat sheet from
api.json”
Development
git clone https://github.com/TheoryofShadows/openapi-summarize-mcp.git
cd openapi-summarize-mcp
npm install
npm testLicense
MIT
Available Tools
4 toolsfind_missing_authA
Find operations missing security/auth requirements in a local OpenAPI file. Reads a local OpenAPI/Swagger JSON or YAML file path only — does not fetch remote specs.
| Name | Required | Description | Default |
|---|---|---|---|
| filePath | Yes | Path to OpenAPI JSON/YAML. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations present, the description carries the full burden, and it usefully discloses a key behavioral constraint: it reads a local path only and will not fetch remote specs. That prevents an agent from passing a URL. It still doesn't clarify what counts as 'missing' auth or how results are returned, so it isn't complete.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences with the core purpose front-loaded and the local-file constraint immediately following. No filler, no restatement of the name.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only, single-parameter analysis tool with no output schema, the description covers what the tool does and its main input constraint. Given the absent output schema, a brief note on the shape of results would help, but it is close to complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There is a single parameter with 100% schema description coverage ('Path to OpenAPI JSON/YAML'), so the schema already documents it fully. The description adds no format or syntax detail beyond the schema, which matches the baseline 3 for high coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource: 'Find operations missing security/auth requirements in a local OpenAPI file.' The purpose is unambiguous and clearly distinct from sibling analysis tools like summarize_by_tag and list_deprecated. It stops short of explicitly naming those siblings, so it lands at 4 rather than 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied by the name and description, and the 'local file path only' constraint narrows the intended scenario. However, it never states when to choose this over siblings or what prerequisites (e.g., a valid spec) are needed, leaving the agent to infer the context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
generate_cheat_sheetA
Generate a short agent-friendly markdown API cheat sheet from a local OpenAPI file. Reads a local OpenAPI/Swagger JSON or YAML file path only — does not fetch remote specs.
| Name | Required | Description | Default |
|---|---|---|---|
| maxOps | No | Max operations to include (default 80, max 500). | |
| filePath | Yes | Path to OpenAPI JSON/YAML. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It usefully discloses that only local JSON/YAML files are read and no network fetch occurs, but says nothing about what happens on an unreadable or malformed spec, whether output is written to disk or returned inline, or any truncation behavior tied to maxOps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences, front-loaded with the purpose and followed by the single most important constraint. No filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple two-parameter read tool with no annotations and no output schema, the description covers what the tool produces (markdown cheat sheet) and its input constraint. It could say a bit more about output shape or failure modes, but nothing essential to invoking it is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so both filePath and maxOps are already documented with defaults and limits. The description reinforces that filePath must be local (not a URL), which adds slight value, but contributes nothing about maxOps beyond the schema. Baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (generate) and a concrete artifact (a short agent-friendly markdown API cheat sheet) derived from a local OpenAPI file. The scope is unambiguous, though it never contrasts itself with siblings like summarize_by_tag or find_missing_auth, so an agent must infer the distinction from the resource alone.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives one clear boundary — local file paths only, remote specs are not fetched — which functions as a 'when-not'. However, it never says when to choose this over summarize_by_tag/find_missing_auth/list_deprecated, and gives no prerequisites such as valid spec format or file accessibility.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_deprecatedA
List deprecated operations in a local OpenAPI file. Reads a local OpenAPI/Swagger JSON or YAML file path only — does not fetch remote specs.
| Name | Required | Description | Default |
|---|---|---|---|
| filePath | Yes | Path to OpenAPI JSON/YAML. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It does disclose the local-only constraint and the accepted input formats, and 'List' implies a non-mutating read, but it says nothing about permissions, error behavior on malformed specs, or result shape.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, zero padding, with the core action and the most important constraint front-loaded in that order.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter, read-only listing tool with no output schema and no nested objects, the description covers the action and the input constraint adequately. A brief note on what a 'deprecated operation' result looks like would make it fully self-contained.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There is a single parameter at 100% schema description coverage, so the baseline is 3. The description restates that only a local file path is accepted (JSON or YAML), which adds the local-only nuance but little beyond what the schema already documents.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource: it lists deprecated operations from an OpenAPI file. The scope is unambiguous, but it does not distinguish itself from the sibling tools (summarize_by_tag, find_missing_auth, generate_cheat_sheet), which appear to operate on the same kind of input.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description sets a clear boundary — local file path only, no remote fetch — which implicitly tells the agent when this tool applies. However, it never contrasts itself with alternatives or states when a sibling tool would be the better choice.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
summarize_by_tagA
Load a local OpenAPI/Swagger file and summarize endpoints grouped by tag. Reads a local OpenAPI/Swagger JSON or YAML file path only — does not fetch remote specs.
| Name | Required | Description | Default |
|---|---|---|---|
| filePath | Yes | Absolute or relative path to OpenAPI JSON/YAML. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden, and it does disclose the key behavioral constraint that it reads local files only and performs no remote fetch. It is silent on error behavior (e.g., missing or malformed file) and does not state the read-only nature explicitly, though 'Load/Reads' implies it.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two front-loaded sentences that state the action first and the scope constraint second. There is mild redundancy, as the local-file-only idea is repeated in the second sentence, but overall it is tight and wastes little.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple single-parameter, annotation-free, output-schema-free tool, the description covers what it does, the accepted input type, and the local-only scope. It is nearly complete, lacking only minor detail such as what happens with an invalid path or how tags with no endpoints are handled.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and there is a single parameter, so the baseline is 3. The description reinforces that the value is a local JSON/YAML path ('path only'), but adds no syntax, format, or validation detail beyond what the schema already states.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description pairs a specific verb ('Load', 'summarize') with a precise resource ('endpoints grouped by tag' from an OpenAPI/Swagger file), so an agent immediately understands the output shape. It also scopes the input to local files, which distinguishes it from any remote-fetching behavior. It does not explicitly contrast itself with the siblings (find_missing_auth, list_deprecated, generate_cheat_sheet), which keeps it just short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The clause 'does not fetch remote specs' serves as an implicit when-not condition, telling the agent this tool is only for local file paths. However, there is no explicit guidance on when to choose this over generate_cheat_sheet or the other sibling analysis tools, so usage is only inferred.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
4 tool updates
v0.1.0- First observed
find_missing_auth - First observed
generate_cheat_sheet - First observed
list_deprecated - First observed
summarize_by_tag
TDQS
Scored across 4 tools
Each tool has a distinct OpenAPI analysis purpose, but summarize_by_tag and generate_cheat_sheet both produce summary-style output and could be confused by an agent at a glance. The specific focus on tags versus a compact cheat sheet helps separate them.
All tool names use consistent snake_case with a verb-led pattern: summarize_by_tag, find_missing_auth, list_deprecated, generate_cheat_sheet. The convention is predictable and readable.
Four tools is well-scoped for a focused OpenAPI summarization/analysis server, and each tool contributes a distinct capability without bloat.
The surface covers the main summarization and audit tasks: grouping by tag, finding missing auth, listing deprecated operations, and generating a cheat sheet. Minor gaps exist, such as listing all endpoints or searching operations, but core workflows are supported.
Maintenance
Related MCP Connectors
Detect breaking changes, generate changelogs, diff, and validate OpenAPI specs.
Generate SBOMs, scan vulnerabilities, and analyze dependencies from local projects or Git repos.
Scan configs, files, or text for leaked secrets and obvious misconfigurations. Nothing stored.
Agent microtools: secret scanning, preflight, receipts, JSON checks and Zero Point analysis.
Related MCP Servers
- AlicenseAqualityBmaintenanceEnables inspecting local OpenAPI specification files by listing and retrieving spec details with filters and $ref resolution.3MIT
- AlicenseAqualityCmaintenanceParses Swagger 2.0 and OpenAPI 3.x specifications, exposing API endpoints, schemas, and authentication through MCP tools with local caching to reduce token usage.1151MIT
- FlicenseNot gradedqualityDmaintenanceEnables AI to scan and query local OpenAPI/Swagger documentation, listing API groups and endpoints, and generating TypeScript type definitions for specific endpoints.-
- FlicenseAqualityCmaintenanceValidates OpenAPI specs from files, inline content, or URLs, and generates prompts for agent developers based on the API analysis.9-