Runtime OpenAPI → MCP bridge — point at any OpenAPI spec and get MCP tools instantly
Single tool 'dynamic_openapi_tools' has critical definition gaps. Tool name is generic and does not follow verb_noun pattern (should be 'call_openapi_endpoint' or similar). Description is present but vague, does not explain WHEN to use it vs other tools, what prerequisites exist, or what the 'arguments' JSON format actually contains. Input schema exists but is severely underspecified: single 'arguments' string parameter with minimal guidance on structure. No output schema documented. No error handling guidance. Tool accepts arbitrary JSON, creating validation and injection risks.
Dynamically generated tools from OpenAPI specification. Each endpoint in the OpenAPI spec becomes an MCP tool with the operation_id as the tool name. Tools accept an 'arguments' parameter containing a JSON string with endpoint parameters (path, query, header, body).
Tool name 'dynamic_openapi_tools' is generic and does not start with an action verb. Should be 'call_openapi_endpoint' or 'invoke_openapi_operation' to signal intent. Generic names force LLMs to guess when to use the tool.
Input schema accepts a single 'arguments' string parameter with no formal structure definition. LLMs cannot validate JSON format, parameter locations (path/query/header/body), or required vs optional fields. This invites malformed calls and injection attacks.
No output schema documented. LLMs cannot plan downstream operations or extract response fields. Tool description does not specify what fields are returned, data types, or pagination behavior.
Error handling is minimal. Handler catches JSON parse errors but returns generic error dict. No guidance on retryability, user-fixable vs fatal errors, or recovery steps. LLMs cannot self-correct on failures.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 25 | 2026-07-28+ | v2 |
Tool accepts arbitrary JSON in 'arguments' parameter with no validation of parameter names, types, or locations. Accepts user-controlled input without sanitization, creating SQL injection, command injection, and path traversal risks.