MCP server for HikerAPI — Instagram data API. Auto-generates tools from the HikerAPI OpenAPI spec.
The HikerAPI MCP server auto-generates tools from an OpenAPI specification at runtime. While the architecture is sound, critical definition quality issues prevent a higher score: (1) Tool definitions are inferred/dynamic rather than explicitly visible in source code. The single registered tool 'dynamic_hikerapi_tools' has a description that explains the mechanism but does NOT list actual parameter requirements for specific API endpoints. (3) No parameter descriptions are provided for individual OpenAPI-derived endpoints, the generic description does not fulfill the requirement that 'every parameter needs a description.' (4) Output structure is not documented, responses are returned as raw text without field documentation. (5) No error classification or recovery guidance is provided. The tool description assumes users will consult the HikerAPI OpenAPI spec directly, which contradicts the pattern that tool descriptions must be self-contained and LLM-optimized.
Dynamically generated tools from OpenAPI specification. Tool names, descriptions, and input schemas are auto-generated from the HikerAPI OpenAPI spec based on path patterns, operation summaries, and parameter definitions.
Input schema is empty/generic. The tool's schema declares `properties: {}` with description 'Input schema varies per tool.' LLMs cannot determine what parameters each endpoint accepts or their types.
Tool name 'dynamic_hikerapi_tools' is generic and non-descriptive. It does not start with an action verb (get, list, search, etc.) or convey what action is performed. The pattern requires verb_noun naming so LLMs can infer intent from the name alone.
No parameter descriptions provided. The tool description states 'Query and path parameters are supported' but does not document what parameters any specific endpoint accepts or what they control. LLMs cannot infer parameter meaning from names alone, the pattern requires explicit parameter documentation.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 23 | 2026-07-28+ | v2 |
Output schema is not documented. Tool responses are returned as raw JSON text wrapped in a single text content block. There is no documentation of what fields will be present in responses, their types, or how downstream tools can extract data.
No error guidance or classification. When HTTP errors occur, the tool returns a generic text block with status code and response body. There is no categorization (retryable vs. user-fixable vs. fatal), no recovery hints, and no actionable guidance for what the LLM should do next.
API key exposure risk. The tool implementation injects `x-access-key` header with the HikerAPI_KEY environment variable into every request. While the key itself is not a tool parameter (correct), there is no scope/permission declaration or audit logging, limiting transparency about what operations the tool can perform.
Tool definitions are inferred/dynamic, not explicitly visible. The tool name and schema are generated at runtime from the OpenAPI spec fetched from an external URL.