An MCP server for building and managing OpenAPI specifications programmatically
Critical gaps across nearly all dimensions. 16 of 31 tools (52%) lack descriptions entirely, 'Not provided in source' appears repeatedly. Of tools with descriptions, most are under 50 chars and lack actionable context (e.g., 'Adds a GET op...' without explaining when to use it vs addOperation). Input schemas are present for only ~8 tools; 23 tools have no visible schema definitions in the provided source. Parameter descriptions are sparse or missing. No output schemas documented. Error handling is absent, no recovery guidance, no categorization of retryable vs fatal errors. Tool naming is inconsistent: addPath, addSchema, addOperation follow verb_noun, but deleteOperation, deleteSchema lack clarity on what 'delete' means (remove from spec? clear definition?). No evidence of idempotency, pagination, or composition patterns. Security: no mention of secret injection, permission gates, or audit trails. This server would not pass code review.
Adds a new tag definition or updates an existing one (based on tagName) in the global tags array.
Adds or updates an OAuth2 flow (and its scopes) to a security scheme.
Adds POST, PUT, DELETE, or PATCH op. Configurable success/error responses. Auto-defines tags.
Adds a new parameter to an operation in the server state spec.
Adds or updates a response, allowing specific media type and schema definition.
Adds a GET op. Configurable success/error responses. Auto-defines tags.
Not provided in source
16 of 31 tools (52%) have no description at all ('Not provided in source').
23 of 31 tools have no visible input schema definitions in source code. LLMs cannot infer parameter types or constraints.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 29 | 2026-07-28+ | v2 |
Not provided in source
Not provided in source
Not provided in source
Not provided in source
Applies a global security requirement. Validates OAuth/OIDC scopes if provided. Overwrites existing global security.
Applies a security scheme to an operation. Validates OAuth/OIDC scopes if provided. Use 'none' to clear security.
Not provided in source
Not provided in source
Not provided in source
Not provided in source
Not provided in source
Not provided in source
Not provided in source
Not provided in source
Not provided in source
Not provided in source
Not provided in source
Not provided in source
Not provided in source
Not provided in source
Not provided in source
Not provided in source
Not provided in source
Not provided in source
No output schemas documented for any tool. LLMs cannot plan downstream calls or extract required fields (e.g., operationId, pathName) for chaining. Violates pattern:tool and mxe:include-chaining-ids.
No error handling guidance. Tools like deleteOperation, deleteSchema, deleteSecurityScheme are destructive but provide no recovery hints, retryability classification, or confirmation patterns. Violates pattern:recovery-guide and pattern:confirmation-request.
No evidence of idempotency, pagination, or composition patterns. List tools (listGlobalTags, listSchemas) lack limit/offset/cursor parameters and total_count returns. No tool chains documented (e.g., addPath → addOperation → addOperationParameter). Violates pattern:paginated-result and pattern:tool-chain.