Is your API ready for people, attackers and AI agents?
Paste an OpenAPI 3 or Swagger 2 document (JSON). Get a grade across documentation, design, security posture and AI-agent readiness, a fix for every issue, and Model Context Protocol tool definitions you can hand to an agent.
Why AI-agent readiness?
AI agents choose and call operations from your descriptions alone. Missing operation IDs, vague descriptions, undocumented errors, unbounded lists and non-idempotent writes make agents guess, retry blindly and pull too much data. The same gaps slow down human integrators, so fixing them pays off twice.
How scoring works
Each check carries a weight by severity (high 3, medium 2, low 1). An area's score is the share of weighted checks it passes. The overall score weights security at 35%, agent readiness at 25%, and documentation and design at 20% each. Security checks follow the OWASP API Security Top 10 (2023) and the OAuth 2.0 Security Best Current Practice. A spec cannot prove an implementation is secure; test the running API too, for example with Endpoint Client's Security Lens.