Back to Browse

Openapi Scout MCP Server

Developer ToolsModerate7.2MCP RegistryLocal
Free

Server data from the Official MCP Registry

Local read-only OpenAPI and Swagger inspection with secret-safe schema summaries. Tools include...

About

Local read-only OpenAPI and Swagger inspection with secret-safe schema summaries. Tools include...

Security Report

7.2
Moderate7.2Low Risk

openapi-scout-mcp is a well-designed local-only OpenAPI inspection tool with strong security controls. Path traversal is properly mitigated via realpath validation, sensitive data is consistently redacted, and there are appropriate file size limits. Minor code quality issues (broad exception handling, unused error class) and one low-severity input validation concern do not significantly impact the security posture. Supply chain analysis found 1 known vulnerability in dependencies (0 critical, 1 high severity). Package verification found 1 issue.

5 files analyzed · 6 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

File System Read

Reads files on your machine. Normal for tools that analyze or process local data.

env_vars

Check that this permission is expected for this type of plugin.

How to Install

Add this to your MCP configuration file:

{
  "mcpServers": {
    "io-github-mrfentmen-openapi-scout-mcp": {
      "args": [
        "-y",
        "openapi-scout-mcp"
      ],
      "command": "npx"
    }
  }
}

Documentation

View on GitHub

From the project's GitHub README.

openapi-scout-mcp

A local-only MCP tool for quickly understanding an OpenAPI or Swagger JSON contract before writing clients, tests, mocks, or documentation.

Tools

  • inspect_spec: summarize version, title, servers, and operations.
  • find_operation: inspect one operation by operationId.
  • list_schemas: list component schemas or Swagger definitions.

Safety boundaries:

  • Only local JSON files are accepted. URLs and network fetches are not supported.
  • Files are capped at 2 MB and results are bounded.
  • Examples, defaults, security schemes, and credential-like keys are redacted.
  • YAML is not parsed in this release. Convert it to JSON first.

This is an inspection aid, not a complete OpenAPI validator or security scanner.

Run

npm install
npm run build
node dist/index.js

Reviews

No reviews yet

Be the first to review this server!