OpenAPI Lint

io.github.basitalisandhuv0.1.1更新于 Oct 5, 2026

Lint OpenAPI 3.x documents for missing security, responses, descriptions and versioning.

已验证STDIO仅桌面Developer ToolsSecurity & Monitoring

概览

AI 生成的概览

检查 OpenAPI 3.x 文档中缺失的安全、响应、描述和版本信息，并可列出或获取其中的操作。

功能
从本地路径或内联 JSON/YAML 加载 OpenAPI 3.0 或 3.1 文档，按严重程度返回带规则 id、JSON Pointer 路径和消息的检查结果。lint_openapi 工具覆盖版本、服务器、安全方案、缺失响应、未描述参数、路径参数、operationId、未版本化路径、空请求体、已弃用操作和未声明标签。list_operations 和 get_operation 列出操作及其生效的安全设置、参数、媒体类型和响应码，explain_rule 说明规则及修复方式。
适用场景
适合在审阅或维护 OpenAPI 规范时，让助手检查完整性和安全声明，或汇总文档定义的操作。它面向规范审阅和文档工作，而不是测试正在运行的 API。
运行要求
通过 stdio 在本地运行；不需要网络访问、账号、API 密钥或环境变量。可用 npx 安装固定版本的包，或用 Docker 运行容器镜像。它读取指定的一个本地文件，最大 5 MB。
安装前请注意
检查结果描述的是文档而非正在运行的 API，不能替代实际测试。只解析本地引用，不会抓取任何内容。请固定包版本，以免更新在未察觉的情况下改变编辑器中运行的内容。

安装

在 SourceWeft 中

  1. 打开 控制台中的 OpenAPI Lint，将其添加到工作区。
  2. 为需要使用其工具的对话启用该服务。

Desktop only，通过 STDIO。 STDIO 服务会启动本地进程，因此需要 SourceWeft 桌面宿主。

其他 MCP 客户端

参照 仓库 中的启动说明。

README

openapi-lint MCP server

Loads an OpenAPI 3.0 or 3.1 document (JSON or YAML, from a local path or inline) and lints it for security and completeness problems; lists and fetches operations with their effective security. Only local #/ references are resolved; nothing is fetched.

Part of dev-mcp-servers. Stdio transport only; the server never opens a port.

Tools

ToolInputWhat it returns
lint_openapipath or document, ignore?Findings sorted by severity with rule id, JSON Pointer path and message: openapi version, http servers, missing, unused or undefined security schemes, operations without security (and explicitly public ones), operations without responses or success responses, undescribed responses and parameters, path parameters not declared or not required, missing or duplicate operationIds, unversioned paths, empty request bodies, deprecated operations, undeclared tags.
list_operationspath or document, tag?, method?, path_prefix?Every operation with operationId, summary, tags, deprecated flag, effective security (public for security: [], inherited-none when nothing applies), parameters, request media types and response codes.
get_operationpath or document, operation_id or method + operation_pathOne operation in full with path-level parameters merged and local references resolved.
explain_ruleruleSeverity, what the rule detects and how to fix it.

Install

Claude Code:

bash
claude mcp add openapi-lint -- npx -y @basitalisandhu/[email protected]

Add -s user to make it available in every project. Any client that reads .mcp.json (Claude Code, Claude Desktop, Cursor):

json
{  "mcpServers": {    "openapi-lint": {      "command": "npx",      "args": ["-y", "@basitalisandhu/[email protected]"]    }  }}

Pin the version as shown so that an update to the package cannot change what runs in your editor without you noticing. From a checkout, use "command": "node", "args": ["<path>/packages/openapi-lint/dist/index.js"] after npm install && npm run build at the repository root.

What it touches

  • Network: None.
  • Local files: Reads the one file you name, up to 5 MB. YAML is parsed with an alias limit.
  • Telemetry: none.

Notes

  • Swagger 2.0 documents are reported by the openapi-version rule rather than linted.
  • Findings describe the document, not the running API.

Build and test

bash
npm install        # at the repository rootnpm run build -w @basitalisandhu/mcp-openapi-lintnpm test -w @basitalisandhu/mcp-openapi-lint

Tests use node:test and the SDK's in-memory transport; they do not reach the network.

Licence

MIT. See LICENSE.

来源：packages/openapi-lint/README.md，提交 58c8c95

工具

0
工具元数据尚未被收录。

版本历史

1
  1. v0.1.1最新Oct 5, 2026