Skip to main content
Glama
deadrime

openapi-explorer-mcp

by deadrime

openapi-explorer-mcp

An MCP server for any OpenAPI 3 spec. It lets an AI agent find endpoints, inspect request and response shapes without loading a megabyte of JSON, generate TypeScript types, and call endpoints — with credentials mapped to the security schemes the spec already declares.

Unlike servers that turn every operation into its own tool, this one stays small: a handful of tools that explore the spec and one generic caller.

Tools

Tool

What it does

api_spec_info

Spec version and age, counts, groups, security schemes with credential status, changes since the previous version.

api_search

Searches method, path, operationId, summary, tags and parameter names.

api_endpoint

Parameters, request and response shapes (compact, depth-limited), danger level, security alternatives, URL.

api_schema

A component schema by name, with drill-down into nested fields and the endpoints that use it.

api_types

TypeScript types for an endpoint's request, response and parameters, generated with @hey-api/openapi-ts.

api_get

Calls a GET endpoint.

api_request

Calls an endpoint with any method. Registered only with OPENAPI_ALLOW_WRITE; destructive endpoints need confirm_danger: true.

api_call_log

Journal of api_request calls with ids from responses, for cleaning up.

api_auth

Mints tokens through the auth module. Registered only when the module supports it.

recipe

Markdown recipes for this API. Registered only with OPENAPI_RECIPES_DIR.

Related MCP server: mcp-swagger

Configuration

Variable

OPENAPI_SPEC_URL

Required. URL or file path of an OpenAPI 3 JSON spec. URLs are cached on disk and revalidated with ETag.

OPENAPI_BASE_URL

Base URL for calls. Required whenever any credential or header is configured; otherwise servers[0].url of the spec is used for anonymous calls.

OPENAPI_AUTH_<SCHEME>

Credential for a security scheme — see Authentication.

OPENAPI_HEADER_<NAME>

A header sent with every call, for specs that don't declare security schemes. OPENAPI_HEADER_X_API_KEY sends x-api-key.

OPENAPI_AUTH_MODULE

Path to an ES module that supplies credentials minted at runtime.

OPENAPI_ENV_FILE

Env file merged into the environment at startup; variables already set win.

OPENAPI_ALLOW_WRITE

1, true or yes registers api_request. Off by default.

OPENAPI_DANGER_FILE

JSON with danger overrides — see Danger rules.

OPENAPI_RECIPES_DIR

Directory of markdown recipes (with a description: line) served by recipe.

OPENAPI_INSTRUCTIONS_FILE

Markdown appended to the instructions the server gives the model.

OPENAPI_SERVER_NAME

Server name reported to the client. Default openapi.

OPENAPI_CACHE_DIR

Spec cache and generated types. Default ~/.cache/openapi-explorer-mcp/<hash of the spec source>.

OPENAPI_CALL_LOG

Journal of api_request calls. Default <cache dir>/calls.jsonl.

OPENAPI_SPEC_TTL_S

How often a URL spec is revalidated. Default 900.

OPENAPI_TIMEOUT_MS

Timeout of spec fetches and calls. Default 20000.

OPENAPI_MAX_RESPONSE_CHARS

Cap on a tool response. Default 40000.

{
  "mcpServers": {
    "my-api": {
      "command": "npx",
      "args": ["-y", "openapi-explorer-mcp"],
      "env": {
        "OPENAPI_SPEC_URL": "https://api.example.com/openapi.json",
        "OPENAPI_BASE_URL": "https://api.example.com",
        "OPENAPI_AUTH_X_API_KEY": "${MY_API_KEY}",
        "OPENAPI_SERVER_NAME": "my-api"
      }
    }
  }
}

Authentication

The server doesn't invent headers — it reads them from the spec. components.securitySchemes says where a secret goes, and each operation's security says which schemes it accepts. You only give a scheme its value.

Credentials. OPENAPI_AUTH_<SCHEME> holds the value for a scheme; the name is upper-cased with every other character replaced by _: x-admin-tokenOPENAPI_AUTH_X_ADMIN_TOKEN, bearerOPENAPI_AUTH_BEARER. The value is placed where the scheme says:

Scheme

Placement

apiKey in header / query / cookie

the named header, query parameter or cookie

http bearer, oauth2, openIdConnect

Authorization: Bearer <value>

http basic

Authorization: Basic … — give user:password or an already encoded value

Which scheme a call uses. security is a list of alternatives. With as: "auto" (the default) the server takes the first alternative whose schemes all have credentials. as can also name a scheme to force it, or be "anonymous". When nothing is configured, a GET is sent anonymously with a note (many GET endpoints declare auth but also answer without it); any other method fails with the name of the variable to set.

Tokens minted at runtime. OPENAPI_AUTH_MODULE points to an ES module whose default export creates a provider. The identity argument of api_get and api_request is passed to it as is. Types are exported by the package:

import type { AuthProviderFactory } from 'openapi-explorer-mcp';

const createAuth: AuthProviderFactory = ({ baseUrl, timeoutMs, env }) => ({
  canProvide: (scheme, { identity }) => scheme === 'bearer' && Boolean(identity ?? env.DEFAULT_USER),
  getCredential: async (scheme, { identity, force }) => mintToken(baseUrl, identity ?? env.DEFAULT_USER, { force, timeoutMs }),
  // optional: registers api_auth
  authenticate: async ({ identity, force }) => ({ identity: identity ?? 'default', accessToken: await mintToken(/* … */) }),
});

export default createAuth;

A static credential from OPENAPI_AUTH_<SCHEME> wins over the module for the same scheme. When a call that used a module credential gets 401, the server asks the module again with force: true and retries once.

What keeps credentials safe

  • Only the person configuring the server sets values; no tool accepts headers or tokens, so the model picks a scheme, never a value.

  • Credentials go only to OPENAPI_BASE_URL, which must be set explicitly when any credential exists. The spec's servers is never trusted with them — the spec is fetched over the network and could point elsewhere.

  • The origin of every request is checked against the base URL before sending; path parameters are URL-encoded.

  • Values never appear in tool output or in the call journal: responses name the scheme, and api_spec_info shows only whether a scheme has a credential.

Danger rules

Every non-GET operation is write, and destructive when it is a DELETE or its path contains drop, purge, reset, destroy, bulk or broadcast. api_request refuses destructive operations without confirm_danger: true. OPENAPI_DANGER_FILE adds exact operations and path words:

{
  "operations": {
    "POST /orders": "creates a real order"
  },
  "pathPatterns": ["close", "withdraw"]
}

Development

npm install
npm run typecheck
npm run build      # tsc into dist/
npm run smoke      # stdio checks against scripts/fixtures/pets.json, no network
npm run check      # all three
npm run smoke:package  # packs the tarball, installs it in a clean directory and runs the smoke there

npm publish runs check and smoke:package first. The package depends on TypeScript 5.9 directly: the type generator declares TypeScript as a peer dependency, and without the pin npm installs TypeScript 7, whose JavaScript API the generator can't use.

License

MIT — see LICENSE.

Available Tools

7 tools
api_call_logCall journalA
Read-only

What api_request has called: endpoint, status and ids from responses — use it to clean up what was created.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNo

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The readOnlyHint annotation already covers the safety profile; the description adds that it exposes response IDs for cleanup, but it does not disclose details such as ordering, pagination, or whether older entries are retained. This is adequate but not rich beyond the annotation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single compact sentence that packs in what is returned and a usage purpose. The phrasing 'What api_request has called' is slightly awkward, but there is no wasted content.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple optional-limit read-only log, the description states the returned fields and the intended cleanup workflow. The lack of an output schema makes a few details like list shape or ordering unknown, but nothing essential for invoking the tool is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% and the description never mentions the limit parameter. The name and schema constraints make limit mostly self-evident, but the description does not compensate for the missing parameter documentation as required at this coverage level.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description identifies the tool as a record of what api_request calls have been made, naming endpoint, status, and response IDs, which clearly distinguishes it from sibling search/get tools. It lacks an explicit verb like 'list' or 'retrieve,' and 'api_request' is a slightly unclear referent, so it is not a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives a concrete use case: use the call log to clean up what was created. It does not name alternatives or state when not to use it, but for a simple read-only journal the context is clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

api_endpointDescribe an endpointB
Read-only

Parameters, request and response shapes (compact, depth-limited), danger level, security alternatives and URL of one endpoint.

ParametersJSON Schema
NameRequiredDescriptionDefault
modeNooutline: a compact pseudo-type; json: the schema with $refs resolvedoutline
depthNoHow deep nested schemas are expanded
endpointYes"METHOD /path", a path with a single operation, or a unique operationId

TDQS

B3.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The readOnlyHint annotation already establishes the tool is non-destructive. The description adds output-related context such as 'danger level' and 'security alternatives', but it does not address tool-specific behaviors like rate limits or auth requirements. This adds some value beyond the annotation without contradicting it.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, compact sentence that is front-loaded with the main purpose. It lists the output aspects without wasted words. It could mention the input format for the endpoint, but the schema covers that, keeping the text appropriately lean.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With only 3 parameters, all fully described in the schema, and a read-only annotation, the description covers the tool's purpose and output scope reasonably well. The output schema is absent, so the description's enumeration of response aspects is helpful. It lacks explicit alternatives but is otherwise complete enough for straightforward invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, with each parameter (endpoint, mode, depth) already documented including enums and defaults. The description's mention of 'compact, depth-limited' hints at the effect of depth/mode, but it does not add significant new meaning beyond the schema baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific resource ('one endpoint') and the details it provides: parameters, request/response shapes, danger level, security alternatives, and URL. While it does not explicitly differentiate this tool from siblings like api_schema or api_get, the 'one endpoint' scoping and the list of output aspects make the purpose clear.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives no guidance about when to use this tool versus the alternatives. It does not mention search, spec-level information, or other tools, and there are no usage prerequisites or exclusions. An agent must infer from the sibling names, which is insufficient.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

api_getCall a GET endpointA
Read-only

Calls a GET endpoint and returns the response. Read-only: the method is fixed.

ParametersJSON Schema
NameRequiredDescriptionDefault
asNo'auto' uses the first security alternative with configured credentials; 'anonymous' sends none; or a security scheme name from the specauto
queryNoQuery-string parameters
endpointYes"METHOD /path", a path with a single operation, or a unique operationId
identityNoIdentity passed to the auth module, e.g. a user id
path_paramsNoPath parameters

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations already declare readOnlyHint=true, and the description adds the useful constraint that the method is fixed to GET. It does not go further to explain auth selection, endpoint resolution, or response behavior despite openWorldHint being present.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences with no filler. The core behavior and read-only constraint are front-loaded, and every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a generic GET-calling tool with five parameters and no output schema, the description is minimally viable but leaves out response format, error behavior, and sibling-tool routing. The annotations and schema cover safety and parameters, but not these operational details.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, and each parameter already has a descriptive schema (e.g., endpoint is 'METHOD /path'). The description itself adds no additional parameter semantics, so the baseline of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Calls') and a specific resource ('a GET endpoint'), and notes that it returns the response. It clearly states what the tool does, but it does not distinguish this tool from siblings like api_endpoint or api_spec_info.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

'Read-only: the method is fixed' implies this is for safe GET requests and not for mutations, giving some context. However, there is no explicit when-to-use guidance, no alternatives named, and no exclusions or conditions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

api_schemaDescribe a schemaA
Read-only

A schema from components by name, compact and depth-limited. path drills into a nested field; usedBy lists the endpoints that reference it.

ParametersJSON Schema
NameRequiredDescriptionDefault
modeNooutline: a compact pseudo-type; json: the schema with $refs resolvedoutline
nameYesSchema name in components.schemas
pathNoDotted path inside the schema, e.g. data.meta
depthNoHow deep nested schemas are expanded

TDQS

A3.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark the tool read-only, and the description adds behavior beyond that: results are compact and depth-limited, path navigation is supported, and a usedBy field lists referencing endpoints. It does not describe error handling or full return structure, but for a read-only introspection tool the disclosed traits are useful and non-contradictory.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loads the core purpose, with the second sentence adding practical detail about path and usedBy. The first phrase is a sentence fragment ('A schema from components by name...'), which slightly hurts clarity, but there is no wasted content.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description partially compensates by mentioning usedBy, but it does not explain what the returned schema looks like, how mode affects the response, or error/not-found behavior. The input schema covers mode and depth, so the remaining gaps are moderate for an agent invoking this tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Input schema covers 100% of parameters with descriptions and defaults, so the description does not need to carry parameter documentation. It reinforces `path` as a drill-down mechanism and depth-limited output, but adds no parameter semantics beyond what the schema already provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description makes clear that the tool returns a schema from components by name and characterizes it as compact and depth-limited, which conveys the resource and format. It does not use a clear verb ('A schema...' rather than 'Gets a schema...') and does not explicitly differentiate from sibling tools like api_types or api_endpoint, but the usedBy detail adds a distinguishing capability.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It implies when the tool is useful by saying `path` drills into nested fields and `usedBy` lists referencing endpoints, which suggests navigation and impact-analysis use cases. However, it gives no explicit when-to-use versus siblings such as api_types or api_endpoint, and no exclusions or alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

api_spec_infoSpec infoB
Read-only

Spec version and age, counts, groups, security schemes with credential status, and changes since the previous version.

ParametersJSON Schema
NameRequiredDescriptionDefault
refreshNoRevalidate the spec now

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description is consistent with the readOnlyHint=true annotation — it describes a read of spec metadata, so no contradiction. It adds some context beyond the annotation by revealing the tool inspects security-scheme credential status and computes changes since the prior version. However, it does not disclose the refresh/caching behavior implied by the refresh parameter or any implications of exposing credential status.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One compact sentence of roughly 16 words with zero filler. The content categories are front-loaded, and every phrase earns its place by naming a distinct piece of information the tool returns.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple read-only tool with one optional parameter and no output schema, the description adequately covers the main content areas an agent needs to know. The refresh parameter behavior is left to the schema, and edge details like the meaning of 'changes since the previous version' are unspecified, but nothing essential is missing for a safe, non-destructive info tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% — the single optional boolean refresh parameter is fully documented in the schema with 'Revalidate the spec now'. The description adds nothing about the parameter, but the baseline of 3 applies because the schema carries the semantic weight; the description neither helps nor hurts here.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description enumerates specific content categories — spec version, age, counts, groups, security schemes with credential status, and changes since the previous version — which clearly identifies what the tool returns and distinguishes it from siblings like api_schema, api_endpoint, and api_types. However, it lacks an explicit verb and reads as a content inventory rather than a statement of action, which costs it the top score.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is given on when to use this tool versus its six siblings (api_search, api_endpoint, api_schema, api_types, api_get, api_call_log). There is no when-to-use, when-not-to-use, or mention of alternatives, leaving the agent to infer selection from the content list alone.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

api_typesTypeScript types of an endpointA
Read-only

Ready-to-paste TypeScript types for the request, response and parameters of an endpoint, generated from the spec with @hey-api/openapi-ts.

ParametersJSON Schema
NameRequiredDescriptionDefault
includeNo
endpointYes"METHOD /path", a path with a single operation, or a unique operationId
name_prefixNoPrefix for generated type names

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The readOnlyHint annotation already indicates this is a safe read-only operation, and the description adds the detail that types are 'generated from the spec with @hey-api/openapi-ts', which is a light behavioral disclosure. It doesn't mention limitations, output format nuances, or whether generation fails, but it does not contradict the annotation either.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single, front-loaded sentence provides all essential information without filler. It characterizes output, scope (endpoint), and generation source in a compact way that an agent can scan and act upon.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is simple and has no output schema, so the description must sufficiently convey what the agent will receive. 'Ready-to-paste TypeScript types' communicates the format well, but the description does not explicitly mention the optional `include`/`name_prefix` parameters or how the output is structured, relying on schema defaults. For a type generation tool this is adequate but not fully comprehensive.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Two of three parameters (`endpoint` and `name_prefix`) already have descriptions in the schema (67% coverage), so the base rating is a 3. The tool description adds value by listing 'request, response and parameters', which maps directly to the `include` enum and helps explain its semantics, but it does not deeply explain filtering, defaults, or how `name_prefix` affects output.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool generates TypeScript types for an endpoint, using the specific verb 'generates' (implied by 'Ready-to-paste') and naming the resource (types for request, response, and parameters). It distinguishes the purpose from siblings like api_schema, which would return raw schemas, but it does not explicitly name other siblings or state what this tool is not.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The purpose statement implicitly suggests when to use it (when you need TypeScript types), but there is no explicit guidance about when not to use it, nor any mention of alternative tools like api_schema or api_endpoint. It leaves the choice of tool inferable from the context provided by sibling names, but without direct comparison.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 7 tool updatesv0.0.2
    • First observedapi_call_log
    • First observedapi_endpoint
    • First observedapi_get
    • First observedapi_schema
    • First observedapi_search
    • First observedapi_spec_info
    • First observedapi_types

TDQS

B3.4/5.0

Scored across 7 tools

Disambiguation4/5

Tools are mostly distinct: api_spec_info, api_search, api_endpoint, api_schema, api_types, api_get, and api_call_log each target a different aspect of API exploration. Slight overlap between api_endpoint (details) and api_types (types) but descriptions clarify their purpose. The reference to api_request in api_call_log hints at a missing tool, but the set itself is clear.

Naming Consistency3/5

Naming follows a consistent 'api_' prefix but the suffix style is mixed: some are nouns (api_spec_info, api_endpoint, api_schema, api_types, api_call_log) while others are verbs (api_search, api_get). This hybrid is readable but not a uniform verb_noun pattern. The inconsistency is mild but noticeable.

Tool Count4/5

With 7 tools, the count is well within the ideal range (3-15). Each tool addresses a distinct need for exploring an OpenAPI spec. However, the mention of api_request in api_call_log suggests there might be an additional tool not listed, which could slightly grow the set but still remain appropriate.

Completeness3/5

The set covers spec overview, endpoint discovery, detail retrieval, schema inspection, type generation, and safe GET execution. It notably lacks a POST/PUT/PATCH tool for actually creating or modifying resources, only supporting read-only GET. Also, api_call_log implies a separate api_request tool that is missing, leaving a gap between logging and executing non-GET calls.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    A
    quality
    D
    maintenance
    Exposes Swagger/OpenAPI API documentation to AI models, enabling exploration, search, and interaction with endpoints, schemas, and execution of API calls.
    14
    1 npm
    2
    MIT