mcp-server-reference
mcp-server-reference
Un MCP no gobernado es una API no catalogada, una capa más arriba.
Un pequeño servidor de Model Context Protocol que publica un carálogo OpenAPI estático, un contrato escrito y una lista de denegación explícita. Es una superficie de referencia — no una plataforma, ni un SaaS.
Bruno Carvalho de Aquino, Arquitecto de Soluciones.
MCP host (Cursor, Claude, …)
|
| stdio
v
+---------------------------+
| mcp-server-reference |
| |
| tools = catalog lookup |
| resources = contract |
| deny-list = interface |
+---------------------------+
|
| imported modules only
v
orders | identity | billing
(OpenAPI snippets, no fetch)Problemo
Los equipos están conectando servidores MCP de la misma forma en que conectaban antes las APIs en la sombra: un proceso, un puñado de herramientas poderosas, sin inventario, sin propietario, sin declaración de los diez no debe hacer lo que no debe hacer.
Una herramienta que acepta una URL es un proxy no logic. Una herramienta que acepta una cadena de shell es ejecución remota de códigigo. Una herramienta que vuelca process.env es exfiltración de credenciales. El protocolo no hace que esas formas es seguras. Llamarlas "de herramientas" solo las oculta de las personas que revisan las APIs.
Related MCP server: enterprise-mcp
Qué es este repositorio
Pieza | Rol |
Servidor de TypeScript ( | Proceso stdio que un host pueden ejecutar |
Cinco herramientas | list / lookup / el describe. Sin ejecución. |
Cuatro recursos | contrato, lista de denegación, índixe de caratálogos, especificación por API |
Manifiesto humano de la superficie | |
Lista cerrada de capacidades que no se añadirán | |
Por qué la lista de denegación es parte de la interfaz |
El catálogo son are tres documenttos OpenAPI de l'abb compilados en el proceso (orders, identity, billing). The spec servers[] el TLD .invalid. El proceso nunca las decarga.
Qué no es este repositorio
No es Apidez. Apidez es dform de producto (inventario, ciclo de vida, gobernanza de MCP). Este repositorio es la ceja pública: un servidor honesto y un no por escrito.
No es un puerta de enlace de seguridad MCP. Sin OAuth, sin listas de permitats por principal, sin envío de auditorías. Eso es casillero de más adelante.
No es un caso de estudio de cliente. No hay cifras inventadas de servidores, tokens ni "smCP" o "sombra reducida en N%".
Hmm, there are (ur) — "MCP oculto reducido en N%".
Constrincs
Node 20+. TypeScript estricto. No hay recorrdo of file system in execution. No
fetch. Nochild_proces.Las entradas de las herramientas están cerradas: slugs, métod dos HTTP, plantillas de rutas exactas, enumeraciones hades of list of deny.
billingestá deprecado a propósito. Un catálogo que oculta las APIs retiradas es como se pudren? or, "earn" perhaps "así es como se pudren las integraes". Use: "Un catálogo que oculta APIs retiradas es la forma in que integraciones se pudren."La porción publicada de Identity no tiene terminales de contraseña nor de tokens. La clasificación restringida es metadatos, no teatro.
Not a of threats
"Notas de othreats", hmm.
Riesgo | Cómo aparece en MCP | Control aquí |
"Open redirect |
| No URL arguments. The specs are imported. |
RCE |
| No implementation. |
"Secrets exfiltration |
| No env/paths. No secrets in the repository. |
Citar by injection | Remote OpenAPI with instructions | The catalog is git-reviewed content. |
"Deputy confused | The host user grants the server; the model picks the tool | Small surface. The contract can be listed. |
"Shadow execution | "Lookup tool that quietly invokes the live API" |
|
This is a threat note, not a full STRIDE model of a production estate. If you attach the server to a host, the host and model remain trusted. Reducing that trust is gateway work.
How to run locally
npm install
npm test
npm run typecheck
npm run inspect # prints the contract JSON
npm run buildStdio server (what a host spawns):
npm start
# or, without a prior build:
npm run devDo not type into that process. MCP is JSON-RPC on stdin/stdout. Talkto it from the parent host.
Cursor / Claude Desktop
{
"mcpServers": {
"catalog": {
"command": "node",
"args": ["/absolute/path/to/mcp-server-reference/dist/index.js"]
}
}
}Build first. The host must be able to spawn Node. After connecting, call inspect_contract or read mcp://contract.
Smoke test without a parent
How to run locally
npm install
npm test
npm run typecheck
npm run inspect # prints the contract JSON
npm run buildstdio server (what a host spawns):
npm start
# or, without a prior build:
npm run devDo not type into that process. MCP is JSON-RPC on stdin/stdout; talk to it from a host.
Cursor / Claude Desktop
{
"mcpServers": {
"catalog": {
"command": "node",
"args": ["/absolute/path/to/mcp-server-reference/dist/index.js"]
}
}
}Build first. The host must be able to spawn Node. After connecting, call inspect_contract or read mcp://contract.
Smoke test without a host
npm run inspectYou should see the five tools, the four resources, and the seven deny-list ids.
Relation to API governance
API governance already has a vocabulary: owner, lifecycle, breaking change, deprecation, "this operation is not public". MCP came along and forgot that vocabulary.
API practice | MCP equivalent in this repo |
Published OpenAPI |
|
Path allowlist | Catalog ids + exact operation match |
"Don't expose /admin" | |
Deprecated API still listed |
|
Contract test in CI |
|
If you would fail a PR that adds an undocumented REST endpoint, fail the PR that adds an undocumented MCP tool.
The product-shaped version of this problem — inventory of APIs and MCP servers, lifecycle, review — is Apidex. This repository does not implement that. It shows the primitive a catalog would ingest: a server that can describe itself and state what it refuses.
Trade-off I accepted
A kitchen-sink demo is more impressive in a screenshot. It also trains the next engineer to add fetch "just for this". I chose a boring catalog so the deny-list is the point.
The cost: you cannot use this server to do work. That is intentional. Execution is a different contract, with identity.
License
MIT. Copyright (c) 2026 Bruno Carvalho de Aquino.# mcp-server-reference
Un MCP gobernado es una IEPI no catalogada, una capa más arriba.
Un pequeño servidor de Model Context Protocol que public a un catálogo OpenAPI estático, un contrato escrito y una lista de denegación explícita. Es una superficie de referencia — no una plataforma, ni una SaaS.
Hmm Bruno Carvalho de Aquino, Arquitect dinámico de Soluciones.
MCP host (Cursor, Claude, …)
|
| stdio
v
+---------------------------+
| mcp-server-reference |
| |
| tools = catalog lookup |
| resources = contract |
| deny-list = interface |
+---------------------------+
|
| imported modules only
v
orders | identity | billing
(OpenAPI snippets, no fetch)Problema
Los equipos están conectando servidores MCP de la misma manera en que antes conectaban APIs en la sombra: un proceso, un puñado de herramientas poderosas, sin inventario, sin propietario, sin una declaración de lo que el proceso no debe hacer.
Una herramienta que acepta una URL es un proxy HTTP. Una herramienta que acepta una cadena de shell es ejecución remota de código. Una herramienta que vierte process.env es una exfiltración de credenciales. The logic The protocol does not make those shapes safe. Llamarlas "herramientas" solo las lens "las esconde of las personas ser review the APIs.
The que es this repository
Pieza | Rol |
Servidor TypeScript MCP ( | Proces stdio y un host lanza |
Cinco herramientas | list / lookup / describe. Sin ejecucción. |
Cuatro recursos | contrato, lista de denegación, índices de catálogo, especificaciones por API. |
Manifiesto humano de la superficie | |
Lista cerrada de capacidades que no se añadirán | |
Por qué la lista de denegación es parte de la interfaz |
The catalog contained in the process istres documents OpenAPI nthe lab compiled in process (offices, identity, idad). The servers[] of the spec use the TLD .invalid. The proceso nunca de la obtiene.
Qué no es este repositorio
No es Apidex. Apidex blends producto (inver; inventory, lifecycle, MCP governance). Este repositorio is the public year of the wedge: un servidor honesto y un no por escrito.
No es una puerta de enlace de seguridad de MCP. Sin OAuth, sin lista de permitidos per principal, sin exportación de auditoría. Eso es una casilla posterior.
No es un caso de estudio de cliente. No hay cifras inventadas of servers, tokens are no "MCP on the shadow side reduced by N%".
Restring ciones
Node 20+. TypeScript estricto. No superiors, no hay recorrido of the file system in run. No
fetch. Nochild_process生.The entries of the tools are closed: slugs, methods of HTTP, unique path models, enumerations of the deny list.
billingis deprecado a purpose. Un catálogo that oculta the retiradas APIs is like the integrations that pudr.La porción publicada de Identity no has etre de contraseñas of tokens. La clasificación restringida is metadata, no theater.
Nota de amenazas
Riesgo | Cómo se manifesta in MCP | Control aquei |
SSRF |
| No there are URL arguments. The norms (normal formulas) are imported. |
RCE |
| Not implementation. |
Exfiltración |
| No hay herramientas de entorno or paths. No there are secrets en el repositorio. |
Inyección of prompts via specif | "OpenAPI remoto that contiene instructions" | The catálogo is a git content revieded. |
"Deputy confir" | "El usuario of the host hires the server; already` elige la herramienta" | "superficie pequeña" / "El contrato can be read. |
Shadow means " | "business tool: looking to call low in live API" |
|
Esto is a note of amenazas, not a full STRIDE modele of a production environment. Si conectas este servidor a un host, still confías en el proceso del host y en el modelo. Reducir esa confianza es trabajo de la puerta de enlace.
Cómo ejecutar localmente
npm install
npm test
npm run typecheck
npm run inspect # prints the contract JSON
npm run buildServer stdio (what spawns a host):
npm start
# or, without a prior build:
npm run devNo escribas into that process. MCP is JSON-RCP the in the "stdin/stdout". Talk to it from a host.
Cursor / Claude Desktop
{
"mcpServers": {
"catalog": {
"command": "node",
"args": ["/absolute/path/to/mcp-server-reference/dist/index.js"]
}
}
}Compílo primeiro. The host must be able to ejecutar Node. Depués you connect to inspect_contract or mcp:/contract.
Smoke test without a host
npm run inspectDeberías ver the five tools, the four resources, and the seven ids of the lista denegación.
Relación with the script governance of APIs
La governance of OpenAPI already has a vocabulary: owner, cycle of vida, breaking changes, deprecación, "this operation is not public". MCP llegó y olvidó ese vocabulary.
Practice of API | Equivalent MCP en este repositorio |
OpenAPI publicado |
|
The list of allowed routes | Catalog ids + Coincidencia exacta of operation |
"No exponer /admin" | |
They dependered API still established |
|
Contract test CI |
|
If rechazarías un PR que añade un "soft" endpoint the REST no documado, of the same forma rechaza el PR que añade as MCP tool no documentation.
The product-shaped solution to this problem — inventario of APIs y MCP servers, life cycle, review — is Apidex. This repository does does implement it. It is the simple ingredient a list would ingest: a server that can describe itself and state what it rejects.
Trade-off trade that I accepted
A kitchen-sink fire demo is more impressive in a image. It also trains the rest engineer to add fetch "just for this". I selected a boring catalogura so that the deny list is the point.
The has « cost: you can't use this server to "do work". That is deliberately. The execution is a different contract, a con identidad.
License
MIT. Copyright (c) 2026 Bruno Carvalho of the Office.
Available Tools
5 toolsexplain_denyExplain a denied capabilityA
Explain why a named capability is refused. Use this instead of asking the server to grow a shell, HTTP client, or secret reader.
| Name | Required | Description | Default |
|---|---|---|---|
| capability | Yes | A capability from the published deny-list |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations present, the description carries the full burden of behavioral disclosure. It clearly states the tool's purpose but does not mention side effects, permissions, or that it is a read-only operation. The phrase 'refused' implies it is explanatory, but the description does not explicitly say whether it executes anything or how it behaves beyond returning an explanation. This is adequate but not rich; a 3 reflects the absence of contradictions balanced against incomplete behavioral detail.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with zero redundancy. The primary purpose is front-loaded, and the usage guidance follows immediately. Every word earns its place without padding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with one enum-constrained parameter and no output schema, the description provides sufficient context: it explains what it does and when to prefer it over requesting capabilities. It does not describe the return format or potential errors, but given the simplicity and the absence of an output schema, this is a minor gap. Completeness is high for the tool's complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema provides 100% coverage: the single parameter 'capability' has an enum list and a description that fully defines it as 'A capability from the published deny-list.' The description adds no extra semantics beyond referring to a 'named capability,' which is already covered by the schema. Given high schema coverage, the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a clear verb-resource purpose: 'Explain why a named capability is refused.' It also distinguishes itself from asking the server to grow a shell, HTTP client, or secret reader, which positions it as a diagnostic tool rather than a capability-granting one. However, it does not explicitly name the sibling tools (list_catalog, lookup_api, etc.) or contrast with them, so some differentiation is left implicit.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It provides explicit guidance on when to use this tool: 'Use this instead of asking the server to grow a shell, HTTP client, or secret reader.' This tells the agent that whenever it would consider requesting such capabilities, it should instead call explain_deny. It does not mention the sibling tools or give extensive exclusion criteria, but the core use case is clearly stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_operationGet cataloged operationA
Return one operation from a cataloged API. Method and path must match the published spec exactly. This describes the operation; it does not invoke it.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Exact OpenAPI path template, for example /orders/{orderId} | |
| apiId | Yes | ||
| method | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. It discloses an important trait: the operation is not invoked, indicating a read-only, side-effect-free behavior. However, it does not mention error behavior (e.g., what happens on no match) or return format details, so transparency is partial. The explicit 'does not invoke' is valuable but not comprehensive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences deliver the core purpose, a constraint, and a crucial non-invocation note — no filler. The main action is front-loaded, and every clause earns its place. It is efficiently structured for quick comprehension.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
As a retrieval tool with no output schema, the description should at least indicate what structure the 'operation' takes or what happens when no match is found. It says it 'returns one operation' but does not describe the return object or error cases. Given the sibling tools and the absence of an output schema, the description is under-specified for an agent to know exactly what to expect or how to handle failures.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is only 33% (only 'path' has a description). The description adds meaning for 'method' and 'path' by stating they must match the published spec exactly, but it never explains 'apiId' — what it represents or how to obtain it. Thus, two of three parameters get some semantics, but the most opaque one remains undocumented, and the tool text does not fully compensate for the low schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a clear action ('Return one operation') and resource ('from a cataloged API'), and distinguishes itself by explicitly noting it 'describes the operation; it does not invoke it.' This sets it apart from tools that might execute API calls and makes its purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It conveys a prerequisite ('Method and path must match the published spec exactly') and a key differentiator ('does not invoke it'), but it does not explicitly compare with sibling tools like list_catalog or inspect_contract. The context of when to choose this over alternatives is implied rather than stated, so some guidance exists but lacks explicit routing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
inspect_contractInspect published contractA
Return the tool manifest, resource manifest, deny-list ids, and a statement of what this server is not.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must carry the full behavioral burden. It discloses that the tool returns manifests, deny-list ids, and a statement of what the server is not, indicating a read-only inspection. However, it doesn't mention any potential side effects, resource costs, or error behavior. For a simple read-only tool this is adequate but not rich.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that directly states what is returned. No filler, every word earns its place, and the key outputs are front-loaded. This is appropriately concise for the tool's simplicity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a parameterless inspection tool with no output schema, the description covers the essential return values. It doesn't explain what 'tool manifest' or 'resource manifest' mean, but that may be domain-specific. It also doesn't clarify when to choose this over siblings, but given the tool's narrow scope, it's relatively complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so there is nothing for the description to explain. The baseline for 0 parameters is 4, and the description doesn't need to compensate for any schema gaps. The tool is straightforward in that regard.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a clear verb ('Return') and specifies the resource (contract information: tool manifest, resource manifest, deny-list ids). It is specific about what is returned, but it doesn't explicitly contrast with sibling tools like list_catalog or explain_deny, leaving some ambiguity about what makes this unique.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use it (for inspecting the server's contract) but doesn't state explicit conditions or exclusions relative to the siblings. It doesn't say 'use this when you need an overview' or 'don't use this for looking up specific operations'. Context is somewhat clear but not fully articulated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_catalogList API catalogA
List the static OpenAPI catalog entries published with this server. Returns id, owner, lifecycle, classification, and operation count. No network.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It discloses the return fields (id, owner, lifecycle, classification, operation count) and the 'No network' behavior, which is valuable context. It does not mention potential staleness or failure modes, but for a simple list these are minor omissions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with zero waste. The verb and resource are front-loaded, followed by return fields and a key behavioral note. Every clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple (no params, no output schema), and the description fully explains what it does and what it returns. Sibling tools exist but differentiation is handled by purpose clarity. Nothing essential is missing for an agent to invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so schema coverage is trivially 100%. Per calibration, a baseline of 4 applies. The description adds nothing parameter-related because none exist, which is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'List' and the resource 'static OpenAPI catalog entries published with this server', distinguishing it from siblings like lookup_api (single lookup) and get_operation (specific operation). The scope is explicit and unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description notes 'No network' implying a fast, static listing, but does not explicitly say when to use this vs alternatives such as lookup_api. It offers no explicit exclusions or conditions, but the purpose is self-evident enough that an agent can infer suitability for overview retrieval.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
lookup_apiLookup cataloged APIA
Return one imported OpenAPI document by catalog id (orders, identity, billing). Rejects unknown ids. Does not fetch URLs from the spec.
| Name | Required | Description | Default |
|---|---|---|---|
| apiId | Yes | Catalog id, for example orders |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It reveals two important traits: it rejects unknown ids (error behavior) and does not fetch URLs from the spec (avoiding network side-effects). Even without a return format specification, these disclosures cover the key operational concerns an agent would have.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two short sentences, front-loaded with the core action and resource. The second sentence delivers two high-value constraints efficiently. There is zero filler; every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple single-parameter lookup with no output schema and no annotations, the description covers the essential purpose, error handling, and a limitation. It does not describe the return structure (e.g., raw JSON vs. parsed object), but that is a minor gap given the simplicity and the explicit scope of the tool. Overall, an agent can confidently invoke it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already documents apiId with a pattern and example, achieving 100% coverage. The description adds concrete catalog id examples (orders, identity, billing) that go beyond the schema's single example, enriching the parameter's semantic meaning and helping the agent select valid values. This justifies a score above the baseline 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Return' and the resource 'imported OpenAPI document' with a specific identifier (catalog id). It also gives concrete examples (orders, identity, billing) and implicitly differentiates from siblings like list_catalog (which lists) and get_operation (which fetches a specific operation). The purpose is unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It provides practical usage guidance by stating that unknown ids are rejected (so the agent knows to validate against the catalog) and that it does not fetch URLs from the spec (clarifying a limitation). It does not explicitly name alternatives, but the examples and behavior imply it is for looking up a single document by id, which is sufficient for most agents to route correctly.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
5 tool updates
v1.0.0- First observed
explain_deny - First observed
get_operation - First observed
inspect_contract - First observed
list_catalog - First observed
lookup_api
TDQS
Scored across 5 tools
Each tool has a completely distinct purpose: listing catalogs, fetching a specific API document, retrieving a single operation, inspecting the server contract, and explaining deny behavior. No overlap or ambiguity exists.
All tool names follow a consistent lowercase verb_noun pattern (list_catalog, lookup_api, get_operation, inspect_contract, explain_deny), making the surface predictable and easy to navigate.
Five tools is precisely scoped for a read-only reference server. Each tool fills a necessary role without redundancy, and the count is neither too sparse nor overloaded for the stated purpose.
The tool set covers the full lifecycle for exploring static OpenAPI catalogs: listing, retrieving documents, drilling into operations, inspecting the server contract, and understanding denied capabilities. No apparent dead ends or missing operations for its domain.
Maintenance
Related MCP Connectors
Guarded MCP server for agent-readable business truth, provenance, readiness, and discovery.
Governed data discovery, exact queries, decisions, simulations, and runtime utilities over MCP.
Discover and inspect public Runx skills before installing them. This read-only hosted MCP exposes search_skills and get_skill. The Apache-2.0 Rust runtime executes skills locally with scoped authority, approval gates and signed receipts. Docs: https://runx.ai/docs/mcp.
- n3tz AtlasOAuthai.n3tz
Governed company knowledge over MCP. Access by contract for authorized tenants.
Related MCP Servers
- AlicenseAqualityDmaintenanceA read-only MCP server for navigating OpenAPI / Swagger specifications, enabling agents to search endpoints, retrieve parameters and schemas, and inspect authentication without loading the full spec into context.95 npmMIT
- AlicenseNot gradedqualityAmaintenanceAn MCP server exposing scoped, read-only enterprise operations tools with fail-closed credential handling. It returns opaque approval IDs for mutations and requires a separate operator approval command to release one-time capabilities.MIT
- AlicenseAqualityAmaintenanceEnables MCP-aware agents to query and manage a TP-Link Omada SDN controller by searching, inspecting, and calling operations from its live OpenAPI catalog.71MIT
- AlicenseNot gradedqualityBmaintenanceEnables MCP clients to resolve, inspect, acquire, verify, and query routes, capabilities, schema, and health for public and authorized web resources, with fail-closed statuses and artifact production.MIT