An MCP server that dynamically generates tools from OpenAPI specifications, allowing LLMs to interact with any OpenAPI-compliant API
Three tools with visible schemas and descriptions, but significant quality gaps. Tool naming lacks action verbs (initialize, tools_list, tools_call are generic/vague). Descriptions are present but brief (10-50 chars), below the 50-200 char LLM-optimized baseline. Parameter descriptions exist but lack detail on constraints, formats, and valid ranges. The 'arguments' parameter in tools_call is a free-form object with no schema, LLMs cannot infer what keys/types are valid. No output schemas documented. Error handling is absent from tool definitions. Security concern: auth_token exposed as a parameter rather than server-side injection.
Initialize the OpenAPI-MCP server with configuration
Execute a tool by name with provided arguments
List all available tools registered from the OpenAPI specification
Tool names lack action verbs. 'initialize', 'tools_list', 'tools_call' are generic and do not convey intent. Should be 'configure_openapi_server', 'list_available_tools', 'execute_tool'.
Descriptions are too brief (10-50 chars). Baseline for LLM-optimized descriptions is 50-200 chars. Current descriptions lack context on WHEN to use each tool and WHAT it returns.
tools_call 'arguments' parameter is a free-form object with no schema. LLMs cannot determine what keys/types are valid. This violates constrained-input pattern and invites hallucinated argument names.
auth_token exposed as a tool parameter. Credentials must use server-side secret injection via environment variables or vault. Agent traces log all parameters, secrets leak into logs.
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 31 | <=2025-11-25 | v2 |
No output schemas documented for any tool. LLMs cannot plan downstream calls or extract required fields without knowing response structure.