Openapi Security Contract Lint

Local stdio MCP server that scans an OpenAPI file and points out lines where endpoints are published without authentication or with weak API key placement.

What you can do

• Inspect an OpenAPI specification for endpoints published with no authentication
• Flag API keys placed in the wrong location, such as query strings or headers
• Report the specific lines in the file where each problem occurs
• No tool list is published, so the exact operations are not documented; the description only covers this linting purpose.

When to use it

Useful when reviewing or auditing an OpenAPI spec before release and you want an assistant to locate endpoints that lack authentication or expose API keys in insecure positions.

Requirements

Runs as a local process over stdio, started with npx from the npm package @readystack/openapi-security-contract-lint, so Node.js and network access for the package download are needed. No authentication, environment variables or headers are declared.