Akto API Security MCP Server - provides tools for API security scanning, vulnerability management, Jira integration, and API token management via Spring AI MCP
Scoring was not performed
ALL parameters marked 'required=false' with no validation guidance. No parameter descriptions explain format, constraints, or valid ranges. LLMs cannot infer what values are acceptable or what format is expected.
No output schemas documented. Clients cannot determine what fields to expect from each tool, preventing proper chaining and data extraction.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-22 | F | 17 | 2026-07-28+ | v2 |
| 2026-03-09 | F | 35 | - | v1 |
Generic error handling via GlobalExceptionHandler returns 'There's an error with Akto System' for all exceptions. Does not categorize errors as retryable, user-fixable, or fatal. No actionable recovery guidance.
deleteApiToken and deleteTestRuns are destructive operations but have no confirmation step or dry-run mode. No error handling to prevent accidental deletion.
Parameter names are ambiguous without descriptions. 'issueType' (integer), does this mean HTTP status, bug/feature type, or severity? 'webhookOption' and 'webhookType' lack clarity on valid values.
No documentation of required authentication or prerequisites. AKTO_API_KEY environment variable is checked at startup, but tools do not document how this is used or what scopes/permissions each tool requires.
bulkCreateJiraTickets and attachFileToIssue suggest composition but no clear chaining documented. If bulk creation returns issue IDs, attachFileToIssue should document accepting those IDs.
Tool descriptions are functional but generic. e.g. 'Add API token to Akto with optional utility specification', when would an agent call this? What does 'utility specification' mean? No dependency hints or use-case guidance.