OpenAPI Lint

io.github.basitalisandhuv0.1.1更新於 Oct 5, 2026

Lint OpenAPI 3.x documents for missing security, responses, descriptions and versioning.

已驗證STDIO僅桌面Developer ToolsSecurity & Monitoring

概覽

AI 產生的概覽

檢查 OpenAPI 3.x 文件缺少的安全性、回應、描述與版本資訊，並可列出或取得其中的操作。

功能
從本機路徑或內嵌 JSON/YAML 載入 OpenAPI 3.0 或 3.1 文件，依嚴重程度回傳含規則 id、JSON Pointer 路徑與訊息的檢查結果。lint_openapi 工具涵蓋版本、伺服器、安全機制、缺少回應、未描述參數、路徑參數、operationId、未版本化路徑、空請求主體、已棄用操作與未宣告標籤。list_operations 與 get_operation 列出操作及其生效的安全設定、參數、媒體類型與回應碼，explain_rule 說明規則與修正方式。
適用情境
適合在審閱或維護 OpenAPI 規格時，讓助理檢查完整性與安全宣告，或彙總文件所定義的操作。它著重規格審閱與文件工作，而非測試正在運作的 API。
執行需求
透過 stdio 在本機執行；不需要網路存取、帳號、API 金鑰或環境變數。可用 npx 安裝固定版本的套件，或以 Docker 執行容器映像。它讀取指定的單一本機檔案，最大 5 MB。
安裝前請注意
檢查結果描述的是文件而非正在運作的 API，不能取代實際測試。只解析本機參照，不會抓取任何內容。請固定套件版本，以免更新在未察覺的情況下改變編輯器中執行的內容。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 OpenAPI Lint，將其新增到工作區。
  2. 為需要使用其工具的對話啟用該服務。

Desktop only，透過 STDIO。 STDIO 服務會啟動本機處理程序，因此需要 SourceWeft 桌面主機。

其他 MCP 客戶端

參照 儲存庫 中的啟動說明。

README

openapi-lint MCP server

Loads an OpenAPI 3.0 or 3.1 document (JSON or YAML, from a local path or inline) and lints it for security and completeness problems; lists and fetches operations with their effective security. Only local #/ references are resolved; nothing is fetched.

Part of dev-mcp-servers. Stdio transport only; the server never opens a port.

Tools

ToolInputWhat it returns
lint_openapipath or document, ignore?Findings sorted by severity with rule id, JSON Pointer path and message: openapi version, http servers, missing, unused or undefined security schemes, operations without security (and explicitly public ones), operations without responses or success responses, undescribed responses and parameters, path parameters not declared or not required, missing or duplicate operationIds, unversioned paths, empty request bodies, deprecated operations, undeclared tags.
list_operationspath or document, tag?, method?, path_prefix?Every operation with operationId, summary, tags, deprecated flag, effective security (public for security: [], inherited-none when nothing applies), parameters, request media types and response codes.
get_operationpath or document, operation_id or method + operation_pathOne operation in full with path-level parameters merged and local references resolved.
explain_ruleruleSeverity, what the rule detects and how to fix it.

Install

Claude Code:

bash
claude mcp add openapi-lint -- npx -y @basitalisandhu/[email protected]

Add -s user to make it available in every project. Any client that reads .mcp.json (Claude Code, Claude Desktop, Cursor):

json
{  "mcpServers": {    "openapi-lint": {      "command": "npx",      "args": ["-y", "@basitalisandhu/[email protected]"]    }  }}

Pin the version as shown so that an update to the package cannot change what runs in your editor without you noticing. From a checkout, use "command": "node", "args": ["<path>/packages/openapi-lint/dist/index.js"] after npm install && npm run build at the repository root.

What it touches

  • Network: None.
  • Local files: Reads the one file you name, up to 5 MB. YAML is parsed with an alias limit.
  • Telemetry: none.

Notes

  • Swagger 2.0 documents are reported by the openapi-version rule rather than linted.
  • Findings describe the document, not the running API.

Build and test

bash
npm install        # at the repository rootnpm run build -w @basitalisandhu/mcp-openapi-lintnpm test -w @basitalisandhu/mcp-openapi-lint

Tests use node:test and the SDK's in-memory transport; they do not reach the network.

Licence

MIT. See LICENSE.

來源：packages/openapi-lint/README.md，提交 58c8c95

工具

0
工具後設資料尚未被收錄。

版本歷史

1
  1. v0.1.1最新Oct 5, 2026