Schemaguard

io.github.sethclawd-progPublished by GitHub account sethclawd-progv0.1.2Updated Oct 24, 2026

API Schema Drift Monitor — detect breaking changes in OpenAPI specs

VerifiedSTDIODesktop onlyDeveloper ToolsData & Analytics

Overview

AI-generated overview

Compares two OpenAPI specs to flag breaking API changes and lint spec quality, with CI-friendly exit codes and JSON output.

What you can do
SchemGuard is an API schema drift monitor that diffs an OpenAPI spec against a baseline and reports changes. It classifies findings as breaking (for example endpoint-removed, field-type-changed, enum-value-removed, auth-requirement-changed) or non-breaking (for example endpoint-added, description-changed, deprecated). It also lints a spec for issues such as missing operationId, missing descriptions, and absent security schemes, and can emit structured JSON for programmatic use.
When to use it
Useful when an assistant needs to check whether an API change would break downstream consumers before deployment, or to review spec quality. It fits CI pipelines and agent workflows that compare a current spec against a known-good baseline.
Requirements
Runs as a local process over stdio, installed from the npm package @sethclawd/schemaguard, so Node.js and npm are needed. No authentication, environment variables, or headers are declared. It reads local spec files.
Before you install
The ci mode uses exit codes to signal results: 0 for no breaking changes, 1 for breaking changes, and 2 for errors, which can block a pipeline. It reads spec files from the local filesystem; no credentials or network access are declared.

Installation

In SourceWeft

  1. Open Schemaguard in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

SchemGuard

API Schema Drift Monitor — detect breaking changes in OpenAPI specs before they break your consumers.

[npm version] [License: MIT]

Why

APIs break silently. A field gets renamed, an endpoint gets removed, an enum value disappears — and downstream consumers break in production. SchemGuard catches these before deploy.

Install

bash
npm install -g schemaguard

Usage

Diff two specs

bash
schemaguard diff old-api.yaml new-api.yaml

Output:

Found 11 change(s):
❌ BREAKING CHANGES (9):──────────────────────────────────────────────────  ⛔ [endpoint-removed]     Endpoint removed: DELETE /pets/{petId}     at: DELETE /pets/{petId}
  ⛔ [field-type-changed]     Parameter type changed: petId (string → integer)     at: GET /pets/{petId} > param petId  ...
🚨 9 breaking change(s) detected — deployment blocked.

CI mode

bash
schemaguard ci --spec ./openapi.yaml --baseline ./main-openapi.yaml
  • Exit 0 = no breaking changes, safe to deploy
  • Exit 1 = breaking changes detected, blocks the pipeline
  • Exit 2 = error (invalid spec, file not found)

Lint a spec

bash
schemaguard lint ./openapi.yaml

Checks for missing operationId, missing descriptions, no security schemes, etc.

JSON output

bash
schemaguard diff old.yaml new.yaml --format json

Returns structured JSON for programmatic consumption by agents and CI tools.

What it detects

Breaking changes (exit code 1)

RuleDescription
endpoint-removedAn endpoint was deleted
method-removedAn HTTP method was removed from a path
required-param-addedA new required parameter was added
param-removedAn existing parameter was removed
request-field-made-requiredA request field became required
field-type-changedA field's type was changed
response-field-removedA response field was removed
enum-value-removedAn enum value was narrowed
auth-requirement-changedSecurity schemes were modified
response-code-removedA response status code was removed

Non-breaking changes (info only)

RuleDescription
endpoint-addedA new endpoint was added
optional-param-addedA new optional parameter was added
response-field-addedA new response field was added
enum-value-addedAn enum value was widened
description-changedDescription or summary text changed
deprecatedAn endpoint was marked as deprecated

GitHub Actions

yaml
- name: Check API compatibility  run: npx schemaguard ci --spec ./openapi.yaml --baseline ./baseline.yaml

Programmatic API

typescript
import { parseSpec, diffSpecs, formatDiff } from 'schemaguard';
const oldSpec = parseSpec('./v1.yaml');const newSpec = parseSpec('./v2.yaml');const result = diffSpecs(oldSpec, newSpec);
if (result.hasBreakingChanges) {  console.log(`${result.breaking.length} breaking changes found`);}

License

MIT

Source: README.md at commit 3a87ea8

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.1.2LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts