Skip to main content
Glama
gokulapap

BugBounty MCP Server

by gokulapap

Analyze an OpenAPI document

openapi_security_analysis
Read-onlyIdempotent

Analyze OpenAPI JSON or YAML to identify operations, authentication coverage, deprecated endpoints, and security signals for API security testing.

Instructions

Analyze supplied JSON or alias-free YAML for operations, authentication coverage, deprecated endpoints, and security signals.

Input Schema

NameRequiredDescriptionDefault
documentYes
document_formatNoauto

Output Schema

NameRequiredDescriptionDefault
findingsYes
format_versionYes
operation_countYes

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv2.2.0

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations cover the safety profile (readOnlyHint, idempotentHint, destructiveHint=false, openWorldHint=false), so the description's 'Analyze supplied' adds little beyond confirming it operates on caller-provided input. It does not disclose the 'alias-free YAML' restriction's operational consequences or any output behavior, but with annotations carrying the burden a 3 is appropriate.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single efficient sentence, front-loaded with the target artifact and then the analysis dimensions. No filler or repetition of the tool name.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With only 2 parameters, an output schema present, and full annotation coverage, the bar is lower, but the 'alias-free' constraint is unexplained and no guidance on input size or format selection is offered. The description is adequate but not complete for an agent needing to prepare the document argument.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate but only partially succeeds: 'JSON or alias-free YAML' gives format context that maps to document_format, yet the required 'document' parameter, its maxLength of 1M chars, and the 'auto' default are not clarified. The enum values and defaults are left to the schema, which does document them structurally even without prose descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('Analyze') and resource ('supplied JSON or alias-free YAML') and enumerates the exact outputs it looks for: operations, authentication coverage, deprecated endpoints, and security signals. The 'alias-free' qualifier is a precise constraint that distinguishes it from a generic document parser.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage ('supplied' document) but does not state when to use this vs. openapi_discovery, which is the obvious sibling that also deals with OpenAPI. No exclusions or prerequisites are given, leaving the agent to infer that discovery finds specs while this one analyzes them.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.