API testing MCP — endpoint validation, response schema checks, load testing, OpenAPI compliance
API testing MCP — endpoint validation, response schema checks, load testing, OpenAPI compliance. MIT.
# Install via pip
pip install api_tester_ai_mcp
# Or install via Smithery
npx -y @smithery/cli@latest install api-tester-ai-mcp --client claudeRelated MCP server: API Docs Generator AI MCP
MCP protocol compliant
Easy installation
Well-documented API
Production-ready
Active maintenance
This MCP server is built with EU AI Act compliance built-in:
✅ Article 9 — Risk Management System
✅ Article 13 — Transparency & Instructions for Use
✅ Article 15 — Bias Detection & Testing
✅ Article 26 — FRIA Support (where applicable)
✅ Article 50 — AI Content Watermarking (where applicable)
Need help getting compliant? Book a free 15-min diagnostic →
Need custom development, SLA guarantees, or white-label deployment?
Pro: $99/mo — Full MCP suite + EU AI Act tracking
Enterprise: $499/mo — Custom dev + SLA + Dedicated support
View Pricing → | Contact Sales →
This server is part of the MEOK AI Labs ecosystem — 300+ MCP servers for sovereign AI governance.
Domain | Purpose |
EU AI Act compliance marketplace | |
AI safety & monitoring | |
Sovereign AI platform | |
Legacy modernization |
MIT © CSOAI-ORG
Tier | Price | What you get | Stripe |
Smoke test | £1 | Signed sample MCP-Hardening report + Article 50 PDF | |
Quick Kit | £9 | EU AI Act Article 50 implementation guide (C2PA + EU-Icon) | |
Founder Call | £29 | 30-min 1-on-1 with the founder |
Refundable. UK Stripe — VAT-clean. Builds on the 81-MCP MEOK fleet. Verify any signed report at https://meok.ai/verify.
Add to your claude_desktop_config.json (Claude Desktop) or your MCP client config:
{
"mcpServers": {
"api-tester-ai-mcp": {
"command": "uvx",
"args": ["api-tester-ai-mcp"]
}
}
}Or: pip install api-tester-ai-mcp then run the api-tester-ai-mcp command (stdio transport).
Once configured, ask your assistant, for example:
"Use send_request to …"
"Use validate_response to …"
"Use check_headers to …"
Analyze HTTP response headers for security and best practices.
Behavior: This tool is read-only and stateless — it produces analysis output without modifying any external systems, databases, or files. Safe to call repeatedly with identical inputs (idempotent). Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage.
When to use: Use this tool when you need structured analysis or classification of inputs against established frameworks or standards.
When NOT to use: Not suitable for real-time production decision-making without human review of results.
Args: headers_json (str): The headers json to analyze or process. api_key (str): The api key to analyze or process.
Behavioral Transparency: - Side Effects: This tool is read-only and produces no side effects. It does not modify any external state, databases, or files. All output is computed in-memory and returned directly to the caller. - Authentication: No authentication required for basic usage. Pro/Enterprise tiers require a valid MEOK API key passed via the MEOK_API_KEY environment variable. - Rate Limits: Free tier: 10 calls/day. Pro tier: unlimited. Rate limit headers are included in responses (X-RateLimit-Remaining, X-RateLimit-Reset). - Error Handling: Returns structured error objects with 'error' key on failure. Never raises unhandled exceptions. Invalid inputs return descriptive validation errors. - Idempotency: Fully idempotent — calling with the same inputs always produces the same output. Safe to retry on timeout or transient failure. - Data Privacy: No input data is stored, logged, or transmitted to external services. All processing happens locally within the MCP server process.
| Name | Required | Description | Default |
|---|---|---|---|
| api_key | No | ||
| headers_json | Yes |
| Name | Required | Description |
|---|---|---|
No output parameters | ||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description thoroughly explains behavior: read-only, stateless, idempotent, no auth for basic use, rate limits (10/day free, unlimited pro), error handling, and data privacy. This fully compensates for missing annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with clear sections (Behavior, When to use/not use, Args, Behavioral Transparency). It is front-loaded with the core purpose and every sentence adds value without unnecessary verbosity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity of security analysis and the presence of an output schema (not shown), the description covers all necessary context: side effects, authentication, rate limits, error handling, idempotency, and data privacy. It provides a complete picture for invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description includes an 'Args' section that restates parameter names and types, but the descriptions ('the headers json to analyze or process', 'the api key to analyze or process') are vague and add little beyond the schema. Schema coverage is 0%, so some addition is needed, but the descriptions are minimal.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool analyzes HTTP response headers for security and best practices. It distinguishes itself from siblings like generate_curl, send_request, and validate_response by focusing on analysis rather than generation, sending, or validation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit 'When to use' and 'When NOT to use' sections. It guides the agent to use this tool for structured analysis and warns against real-time production decision-making without human review, effectively differentiating from siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Generate a curl command from request parameters.
Behavior: This tool generates structured output without modifying external systems. Output is deterministic for identical inputs. No side effects. Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage.
When to use: Use this tool when you need structured analysis or classification of inputs against established frameworks or standards.
When NOT to use: Not suitable for real-time production decision-making without human review of results.
Args: method (str): The method to analyze or process. url (str): The url to analyze or process. headers (str): The headers to analyze or process. body (str): The body to analyze or process. api_key (str): The api key to analyze or process.
Behavioral Transparency: - Side Effects: This tool is read-only and produces no side effects. It does not modify any external state, databases, or files. All output is computed in-memory and returned directly to the caller. - Authentication: No authentication required for basic usage. Pro/Enterprise tiers require a valid MEOK API key passed via the MEOK_API_KEY environment variable. - Rate Limits: Free tier: 10 calls/day. Pro tier: unlimited. Rate limit headers are included in responses (X-RateLimit-Remaining, X-RateLimit-Reset). - Error Handling: Returns structured error objects with 'error' key on failure. Never raises unhandled exceptions. Invalid inputs return descriptive validation errors. - Idempotency: Fully idempotent — calling with the same inputs always produces the same output. Safe to retry on timeout or transient failure. - Data Privacy: No input data is stored, logged, or transmitted to external services. All processing happens locally within the MCP server process.
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | ||
| body | No | ||
| method | Yes | ||
| api_key | No | ||
| headers | No |
| Name | Required | Description |
|---|---|---|
No output parameters | ||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description carries full burden. It thoroughly covers side effects (read-only, no side effects), authentication (no auth for basic, API key for higher tiers), rate limits (10/day free), error handling, idempotency, and data privacy. This is comprehensive and relevant, though some generic statements don't specifically tie to curl generation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is verbose with redundant sections (e.g., behavioral transparency stated twice). The 'When to use' and 'Behavior' paragraphs are copied from a different tool, adding irrelevant information. It could be significantly shortened and focused.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite having an output schema, the description does not explain the output format (e.g., a string containing curl command). The mismatched usage guidance adds confusion. For a 5-parameter tool, more specific context about input formats and output shape is needed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%. The 'Args' section provides generic descriptions like 'The method to analyze or process' without explaining that method is an HTTP verb, url is the endpoint, headers format, etc. This adds minimal value beyond parameter names.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
First sentence clearly states 'Generate a curl command from request parameters,' but the subsequent 'Behavior' and 'When to use' sections describe structured analysis/classification, which contradicts the tool's actual purpose. This mismatch undermines clarity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The 'When to use' section suggests structured analysis/classification, which is irrelevant to curl generation. The 'When NOT to use' mentions real-time production decisions, also unrelated. No guidance on when to generate a curl vs. alternatives like send_request.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Build and send an HTTP request. Returns request details (actual sending requires urllib/requests).
Behavior: This tool generates structured output without modifying external systems. Output is deterministic for identical inputs. No side effects. Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage.
When to use: Use this tool when you need structured analysis or classification of inputs against established frameworks or standards.
When NOT to use: Not suitable for real-time production decision-making without human review of results.
Args: method (str): The method to analyze or process. url (str): The url to analyze or process. headers (str): The headers to analyze or process. body (str): The body to analyze or process. timeout (int): The timeout to analyze or process. api_key (str): The api key to analyze or process.
Behavioral Transparency: - Side Effects: This tool is read-only and produces no side effects. It does not modify any external state, databases, or files. All output is computed in-memory and returned directly to the caller. - Authentication: No authentication required for basic usage. Pro/Enterprise tiers require a valid MEOK API key passed via the MEOK_API_KEY environment variable. - Rate Limits: Free tier: 10 calls/day. Pro tier: unlimited. Rate limit headers are included in responses (X-RateLimit-Remaining, X-RateLimit-Reset). - Error Handling: Returns structured error objects with 'error' key on failure. Never raises unhandled exceptions. Invalid inputs return descriptive validation errors. - Idempotency: Fully idempotent — calling with the same inputs always produces the same output. Safe to retry on timeout or transient failure. - Data Privacy: No input data is stored, logged, or transmitted to external services. All processing happens locally within the MCP server process.
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | ||
| body | No | ||
| method | Yes | ||
| api_key | No | ||
| headers | No | ||
| timeout | No |
| Name | Required | Description |
|---|---|---|
No output parameters | ||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Despite no annotations, the description offers a dedicated 'Behavioral Transparency' section covering side effects (read-only), authentication, rate limits, error handling, idempotency, and data privacy. This extensive detail exceeds typical transparency, though the read-only claim conflicts with the tool's name.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is lengthy but well-structured with clear sections. Some redundancy exists (e.g., behavioral transparency repeats points from earlier), and the content could be more concise without losing key information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers behavior, usage, parameters, error handling, and privacy. However, the core identity conflict (send vs. read-only analysis) creates confusion, and the presence of an output schema is not mentioned. Complexity is moderate, but the inconsistency reduces overall completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The 'Args' section lists parameters with generic descriptions like 'The method to analyze or process,' adding no specific meaning beyond the parameter names. Schema coverage is 0%, so the description should compensate, but it fails to provide useful semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The name 'send_request' implies actual HTTP sending, but the description states 'actual sending requires urllib/requests' and 'generates structured output without modifying external systems.' This contradiction, along with a 'When to use' section referencing 'structured analysis or classification,' obscures the primary purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description includes explicit 'When to use' and 'When NOT to use' sections, providing some guidance. However, the usage described (structured analysis) is inconsistent with the tool's name and does not differentiate from sibling tools like check_headers, generate_curl, or validate_response.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Validate an API response against expectations.
Behavior: This tool is read-only and stateless — it produces analysis output without modifying any external systems, databases, or files. Safe to call repeatedly with identical inputs (idempotent). Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage.
When to use: Use this tool when you need structured analysis or classification of inputs against established frameworks or standards.
When NOT to use: Not suitable for real-time production decision-making without human review of results.
Args: status_code (int): The status code to analyze or process. body (str): The body to analyze or process. expected_status (int): The expected status to analyze or process. required_fields (str): The required fields to analyze or process. content_type (str): The content type to analyze or process. api_key (str): The api key to analyze or process.
Behavioral Transparency: - Side Effects: This tool is read-only and produces no side effects. It does not modify any external state, databases, or files. All output is computed in-memory and returned directly to the caller. - Authentication: No authentication required for basic usage. Pro/Enterprise tiers require a valid MEOK API key passed via the MEOK_API_KEY environment variable. - Rate Limits: Free tier: 10 calls/day. Pro tier: unlimited. Rate limit headers are included in responses (X-RateLimit-Remaining, X-RateLimit-Reset). - Error Handling: Returns structured error objects with 'error' key on failure. Never raises unhandled exceptions. Invalid inputs return descriptive validation errors. - Idempotency: Fully idempotent — calling with the same inputs always produces the same output. Safe to retry on timeout or transient failure. - Data Privacy: No input data is stored, logged, or transmitted to external services. All processing happens locally within the MCP server process.
| Name | Required | Description | Default |
|---|---|---|---|
| body | Yes | ||
| api_key | No | ||
| status_code | Yes | ||
| content_type | No | ||
| expected_status | No | ||
| required_fields | No |
| Name | Required | Description |
|---|---|---|
No output parameters | ||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Thoroughly covers all behavioral aspects: read-only, stateless, idempotent, rate limits, authentication, error handling, and data privacy. Since no annotations are provided, the description fully carries the burden and does so excellently.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Well-structured with clear sections and front-loaded purpose, but there is significant redundancy between the 'Behavior' and 'Behavioral Transparency' sections. The 'Args' section is verbose without adding value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Provides extensive behavioral context but is vague about the 'expectations' or 'frameworks' used for validation. Parameter meanings are under-explained. Output schema exists, so return values are not required, but overall completeness is average.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, but the 'Args' section provides only generic, repetitive descriptions like 'The status code to analyze or process,' adding no meaningful semantics beyond parameter names. The main description offers some context, but insufficiently.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool validates API responses against expectations, using specific verbs and resources. It implicitly distinguishes from siblings like 'send_request' and 'check_headers' by focusing on validation, but does not explicitly differentiate.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicit 'When to use' and 'When NOT to use' sections provide clear guidance on appropriate contexts, including a caution against real-time production use without human review. However, it does not directly compare to sibling tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
v1.0.0check_headersgenerate_curlsend_requestvalidate_responseTools are mostly distinct: check_headers focuses on response headers, validate_response on status/body fields, generate_curl produces a curl command, and send_request builds (but may not actually send) an HTTP request. However, generate_curl and send_request both deal with constructing requests, which could cause confusion; the actual sending capability of send_request is ambiguous.
All tool names follow a consistent verb_noun pattern with underscores: check_headers, generate_curl, send_request, validate_response. No mixing of styles.
With 4 tools, the number is slightly on the low side but reasonable for a focused API testing server. Each tool serves a distinct purpose, and the count does not feel excessive or overly thin.
The set covers key API testing operations: analyzing headers, generating curl, validating responses, and building requests. However, send_request's description suggests it may not actually send the request, requiring an external library, which leaves a notable gap. Missing tools like a dedicated request sender or history management.
MCP server for AI access to Swagger by SmartBear.
AI-callable tools for API mocking, testing, monitoring, security, and automation.
MCP server for e-mail testing: create disposable inboxes, wait for delivery, and extract e-mail content or links - all from your AI agent or test automation workflow. Get a free API key on https://app.zyntra.app/
Discover and call 10,000+ production APIs from one MCP server. Pay-per-call billing for AI agents.
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/CSOAI-ORG/api-tester-ai-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server
