Caitlyn Openapi Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Caitlyn Openapi Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
MCP server that exposes OpenAPI specifications as queryable documentation resources for LLMs, with Scalar deep links.
$ref references (including remote refs) using Prancedocs_url pointing to Scalar documentationFor isolated execution without global installation:
uvx caitlyn-openapi-mcpInstall from PyPI:
pip install caitlyn-openapi-mcpFor local development or testing:
git clone https://github.com/caitlyn-ai/caitlyn-openapi-mcp.git
cd caitlyn-openapi-mcp
pip install -e ".[dev]"The server is configured via environment variables:
OPENAPI_SPEC_URL: Full URL to the OpenAPI JSON/YAML specificationhttps://api.example.com/openapi.jsonhttps://raw.githubusercontent.com/org/repo/main/openapi.yamlDOCS_RENDERER: Documentation renderer type (default: "scalar")"scalar" is supportedDOCS_BASE_URL: Base URL of the Scalar documentation UIhttps://api.example.com/docshttps://api.example.com/scalardocs_url fields will be nullMCP_TRANSPORT: Transport mode (default: "stdio")"stdio": For local development and Claude Desktop (default)"streamable-http": For AWS Bedrock AgentCore deploymentFor observability in production environments. See [TELEMETRY.md](docs/TELEMETRY.md) for complete documentation including local development setup with Jaeger.
Local Development:
The make dev command automatically starts an OTEL Collector with Jaeger UI for visualizing traces:
# Start dev environment with OTEL collector + Jaeger
make dev
# View traces and logs in Jaeger UI
open http://localhost:16686General OTEL Configuration:
ENABLE_TELEMETRY: Enable/disable telemetry (default: "true")OTEL_SERVICE_NAME: Service name for tracing (default: "caitlyn-openapi-mcp")OTEL_EXPORTER_OTLP_ENDPOINT: OTLP endpoint for traces (e.g., "http://localhost:4317")AWS Bedrock AgentCore (ADOT):
The Docker image includes AWS Distro for OpenTelemetry (ADOT) for native AgentCore integration. When deployed to AgentCore, traces are automatically exported to CloudWatch.
Pre-configured environment variables (already set in Dockerfile):
OTEL_PYTHON_DISTRO=aws_distroOTEL_PYTHON_CONFIGURATOR=aws_configuratorOTEL_TRACES_EXPORTER=otlpOTEL_EXPORTER_OTLP_PROTOCOL=http/protobufAdditional variables for non-AgentCore hosted deployment:
AWS_DEFAULT_REGION, AWS_REGION: AWS regionAWS_ACCOUNT_ID, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY: AWS credentialsENABLE_TELEMETRY=true: Enable OpenTelemetry observabilityInstrumented operations:
The easiest way to use this server with Claude Desktop. No installation required - uvx automatically downloads and runs the package.
Config file location:
~/Library/Application Support/Claude/claude_desktop_config.json%APPDATA%\Claude\claude_desktop_config.json{
"mcpServers": {
"openapi-docs": {
"command": "uvx",
"args": ["caitlyn-openapi-mcp"],
"env": {
"OPENAPI_SPEC_URL": "https://api.example.com/openapi.json",
"DOCS_BASE_URL": "https://api.example.com/docs"
}
}
}
}For testing local changes to the server code.
Prerequisites: Clone the repo and install in development mode (see Local Development)
{
"mcpServers": {
"openapi-docs": {
"command": "python",
"args": ["-m", "openapi_mcp.server"],
"env": {
"OPENAPI_SPEC_URL": "https://api.example.com/openapi.json",
"DOCS_BASE_URL": "https://api.example.com/docs"
}
}
}
}Note: Use the full path to Python if it's not in your PATH: "/usr/local/bin/python3.11"
For interactive testing with a web UI before deploying to Claude Desktop.
Prerequisites:
Quick start:
make devOr manually set your own API:
npx @modelcontextprotocol/inspector \
-e OPENAPI_SPEC_URL="https://api.example.com/openapi.json" \
-e DOCS_BASE_URL="https://api.example.com/docs" \
python -m openapi_mcp.serverSee Testing with MCP Inspector for more details.
Deploy as a containerized service with streamable-http transport and AWS Distro for OpenTelemetry (ADOT) for native observability.
Features:
Quick start:
.env.example to .env and configure: cp .env.example .env
# Edit .env with your OPENAPI_SPEC_URL and AWS credentials docker-compose up openapi-mcp-bedrockSee full examples:
Build and run:
docker build -t openapi-mcp .
docker run -p 8000:8000 openapi-mcpConfigure your Bedrock agent to connect to the HTTP endpoint.
Connect to multiple OpenAPI specifications simultaneously by running separate server instances.
{
"mcpServers": {
"production-api": {
"command": "uvx",
"args": ["caitlyn-openapi-mcp"],
"env": {
"OPENAPI_SPEC_URL": "https://api.prod.example.com/openapi.json",
"DOCS_BASE_URL": "https://docs.prod.example.com"
}
},
"staging-api": {
"command": "uvx",
"args": ["caitlyn-openapi-mcp"],
"env": {
"OPENAPI_SPEC_URL": "https://api.staging.example.com/openapi.json",
"DOCS_BASE_URL": "https://docs.staging.example.com"
}
},
"caitlyn-api": {
"command": "uvx",
"args": ["caitlyn-openapi-mcp"],
"env": {
"OPENAPI_SPEC_URL": "https://betty.getcaitlyn.ai/docs/openapi-v1.json",
"DOCS_BASE_URL": "https://betty.getcaitlyn.ai/api/docs"
}
}
}
}Each server runs independently with its own OpenAPI specification.
which python (macOS/Linux) or where python (Windows)"/usr/local/bin/python3.11"~/Library/Logs/Claude/mcp*.log (macOS)OPENAPI_SPEC_URL is accessible from your machinepip install caitlyn-openapi-mcp or pip install -e ".[dev]" in the repopython -m openapi_mcp.server --helpcurl https://your-api.com/openapi.json$ref references, the server will load it anyway with warningsThe server exposes one static resource:
api-specificationThe complete OpenAPI 3.x specification in JSON format (fully resolved with all $refs expanded). Can be used with OpenAPI validation tools, code generators, or for reference.
The server provides tools designed to help LLMs answer user questions about the API. Each tool includes contextual descriptions to guide when it should be used.
list_api_endpointsUse for: Getting an overview of what the API can do, or finding endpoints by category.
Parameters:
tag (optional): Filter by API category/tag (e.g., "users", "posts", "auth")search (optional): Search term to find endpoints (searches paths, descriptions, summaries)Returns: List of endpoints with path, method, summary, description, tags, and docs_url
Example use cases:
get_endpoint_detailsUse for: Getting detailed information about a specific endpoint including parameters, request body, and responses.
Parameters:
method: HTTP method (GET, POST, PUT, DELETE, PATCH, etc.)path: API path (e.g., "/api/v1/users" or "/users/{userId}")Returns: Complete endpoint details including parameters, request body schema, response schemas, and docs_url
Example use cases:
get_schema_definitionUse for: Understanding the structure of request/response data models.
Parameters:
schema_name: Name of the schema (e.g., "User", "CreateUserRequest", "PaginatedResponse")Returns: Schema definition with properties, types, required fields, and docs_url
Example use cases:
search_api_endpointsUse for: Finding endpoints by functionality when you don't know the exact path.
Parameters:
query: What the user wants to do (e.g., "create knowledge base", "upload file", "get user profile")max_results (optional, default: 20): Maximum number of results to returnReturns: Matching endpoints with path, method, summary, description, tags, and docs_url
Example use cases:
list_api_tagsUse for: Understanding how the API is organized into functional categories.
Parameters: None
Returns: List of tags/categories with endpoint counts
Example use cases:
When DOCS_BASE_URL is configured, the server generates deep links to Scalar documentation:
Format: {base_url}#tag/{tag}/{method}/{path}
Example: https://api.example.com/docs#tag/users/get/api/v1/users
tag: The first tag on the operation (defaults to "default" if no tags)method: HTTP method in lowercase (get, post, etc.)path: OpenAPI path with leading slash strippedFormat: {base_url}#schema/{schemaName}
Example: https://api.example.com/docs#schema/User
Format: {base_url}#security/{schemeName}
Example: https://api.example.com/docs#security/bearerAuth
Clone the repository and install in development mode:
git clone https://github.com/caitlyn-ai/caitlyn-openapi-mcp.git
cd caitlyn-openapi-mcp
pip install -e ".[dev]"The installation automatically downloads the sentence-transformers model (~80MB) to ./models/ for semantic search.
Startup behavior:
Caching strategy:
make setup-modelsmake clean-modelsNote: Docker images include pre-downloaded models for instant container startup.
The MCP Inspector provides a web-based UI for testing your MCP server locally with full observability.
Prerequisites:
Quick start with Make:
make devThis launches:
The inspector will open a web interface where you can:
The Jaeger UI will automatically open in your browser to view traces and logs.
Manual usage with custom API:
npx @modelcontextprotocol/inspector \
-e OPENAPI_SPEC_URL="https://api.example.com/openapi.json" \
-e DOCS_BASE_URL="https://api.example.com/docs" \
-e OTEL_EXPORTER_OTLP_ENDPOINT="http://localhost:4317" \
python -m openapi_mcp.serverFor complete telemetry documentation, see TELEMETRY.md.
# Run all tests
pytest
# Run with coverage
pytest --cov=src --cov-report=html
# Run specific test files
pytest tests/test_openapi_loader.py# Format code
black src tests
# Lint code
ruff check src tests
# Type checking
pyright
# Run all checks
black src tests && ruff check src tests && pyright && pytestThe server is built with the following components:
This project is licensed under the MIT License - see the LICENSE file for details.
Contributions are welcome! Please see CONTRIBUTING.md for guidelines on how to contribute to this project.
For security issues, please refer to our Security Policy.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.