← Back to search

@dawmatt/api-grade-mcp

GitHub Actions Scanned 22d ago

MCP server exposing api-grade capabilities for LLMs and agentic AI tooling

npm
D
40 / 100

Versions

0.5.0latest
Jun 27, 2026
0.4.0
Jun 23, 2026
0.3.0
Jun 21, 2026
0.2.1
Jun 20, 2026
0.1.4
Jun 20, 2026
+ show 4 moreshow less
0.1.3
Jun 20, 2026
0.1.2
Jun 19, 2026
0.1.1
Jun 19, 2026
0.1.0
Jun 19, 2026
PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 7

grade-api-detailed
annotations: none low

Grade an API specification and return the full result including all individual violations, per-category breakdowns, and prioritised recommendations. Use this when you need to analyse specific violations or present detailed findings to the user. Supports OpenAPI (2.x, 3.x) and AsyncAPI (2.x, 3.x).

get-ruleset-config
annotations: none low

Return the active Spectral ruleset used by this MCP server when no rulesetPath is supplied on a grading request. Supports three scopes: session (in-memory, resets on server restart), workspace (persisted in workspace), and global (persisted to home). Return configuration at every scope, indicate which scope is currently in effect (the effective ruleset), and show the full resolution chain. Use this to diagnose why a particular ruleset is being applied or to confirm a set-ruleset-config call took effect.

assert-api-grade
annotations: none low

Assert that an API specification meets a minimum grade threshold. Returns a structured pass/fail result. Use this in AI-assisted code review workflows or quality gates. Grade ordering: A (best) > B > C > D > F (worst).

analyse-ruleset-safety
annotations: none low

Inspect a Spectral ruleset

grade-api
annotations: none low

Grade an API specification file and return quality score, letter grade, and diagnostic summary. Use this for a token-efficient overview without the full violations list. Supports OpenAPI (2.x, 3.x) and AsyncAPI (2.x, 3.x) specifications in YAML or JSON.

set-ruleset-config
annotations: none low

Set the default Spectral ruleset used by this MCP server when no rulesetPath is supplied on a grading request. Supports three scopes: session (in-memory, resets on server restart), workspace (persisted to .api-grade/config.json in the workspace root), and global (persisted to ~/.api-grade/config.json). Optionally configure authentication for rulesets hosted in secured locations.

grade-api-remediation-safety
annotations: none low

Return a classified, AI-actionable list of diagnostics filtered by remediation safety level: `safe` (non-breaking, safe to auto-apply), `humanreview` (typically additive/clarifying but should be confirmed by a human before applying at scale), or `unsafe` (could change request/response validation, required fields, types, or the parameter surface — requires human or explicitly-confirmed-agent review). Each returned item also carries a confidence indicator (riskLevel/confidenceLevel) explaining how sure the analyser is in its classification. Use this tool (not grade-api-detailed) when the goal is for the AI to safely resolve violations; the AI generates the corrected specification content and the MCP server does not modify files.

Permissions 4

network medium
Server uses network capabilities via: fetch()
filesystem low
Server uses filesystem capabilities via: fs/promises
shell high
Server uses shell capabilities via: child_process, execSync(), spawnSync()
env_vars low
Server uses env_vars capabilities via: process.env

Scan Findings 35

low
Tool 'grade-api-detailed' has no annotations annotation_checker · 100%
low
Tool 'get-ruleset-config' has no annotations annotation_checker · 100%
low
Tool 'assert-api-grade' has no annotations annotation_checker · 100%
low
Tool 'analyse-ruleset-safety' has no annotations annotation_checker · 100%
low
Tool 'grade-api' has no annotations annotation_checker · 100%
low
Tool 'set-ruleset-config' has no annotations annotation_checker · 100%
low
Tool 'grade-api-remediation-safety' has no annotations annotation_checker · 100%
medium
OAuth implementation without PKCE auth_checker · 75%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
medium
Suspicious package name: react-dom dependency_analyzer · 60%
medium
Vulnerable dependency: vitest@1.6.0 (GHSA-5xrq-8626-4rwp) dependency_analyzer · 95%
medium
Vulnerable dependency: vitest@1.6.0 (GHSA-9crc-q9x8-hgqq) dependency_analyzer · 95%
medium
Vulnerable dependency: express@4.18.0 (GHSA-qw6h-vgh9-j6wx) dependency_analyzer · 95%
medium
Vulnerable dependency: express@4.18.0 (GHSA-rv95-896h-c2vc) dependency_analyzer · 95%
medium
Vulnerable dependency: @modelcontextprotocol/sdk@1.0.0 (GHSA-w48q-cv73-mx4w) dependency_analyzer · 95%
medium
Vulnerable dependency: zod@3.22.0 (GHSA-m95q-7qp3-xv42) dependency_analyzer · 95%
info
package.json metadata manifest_parser · 100%
info
Tool: grade-api-detailed manifest_parser · 70%
info
Tool: get-ruleset-config manifest_parser · 70%
info
Tool: assert-api-grade manifest_parser · 70%
info
Tool: analyse-ruleset-safety manifest_parser · 70%
info
Tool: grade-api manifest_parser · 70%
info
Tool: set-ruleset-config manifest_parser · 70%
info
Tool: grade-api-remediation-safety manifest_parser · 70%
info
Transport: stdio manifest_parser · 90%
info
Required env vars (1) manifest_parser · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 70%
low
Permission: filesystem access detected permission_analyzer · 90%
high
Permission: shell access detected permission_analyzer · 95%
low
Permission: env_vars access detected permission_analyzer · 90%
info
SBOM generated: 1500 components sbom_generator · 100%
critical
GitHub Personal Access Token found in DawMatt-api-grade-7ff7200/docs/backstage-plugins/quick-start.md secret_scanner · 95%
critical
GitHub Personal Access Token found in DawMatt-api-grade-7ff7200/docs/backstage-plugins/configuration.md secret_scanner · 95%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%