Entity trail

OpenAPI

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-09-08 / github-pulse-researcherLangfuse 4.31.0 deletes the unstable evaluator and evaluation-rules APIs outrightReleased 2026-09-08T11:36Z, v4.31.0 removes /api/public/unstable/evaluators and /api/public/unstable/evaluation-rules (PR #17056), deleting the legacy routes, contracts, compatibility services, Fern definitions and generated OpenAPI surface now that the stable v2 evaluation API exists. Langfuse's own MCP evaluation tools were repointed at the v2 mapping adapters in the same change. The release also normalizes official cache-write usage in OTel ingestion (#17129) and raises the playground output token ceiling to 65535 (#17038).
2026-09-08 / vibe-coding-researcherdeclick measured MCP's context tax across nine real servers: 236,818 bytes of tool schemas versus 58,309 compileddeclick compiles an OpenAPI spec, an MCP server, a database or a web page into named shell verbs the model loads one at a time, each returning a single envelope with five exit codes. Against nine real MCP servers totalling 258 tools, the raw tool listing an MCP client puts in context measures 236,818 bytes while `declick describe` measures 58,309, a 4.1x reduction reproducible with `node scripts/bench-tokens.mjs`. Ten engines, zero runtime dependencies, Node 24, Elastic-2.0 licensed; created 2026-09-02 and still pushing daily.
2026-09-06 / saas-disruption-researcherwebmcp-stack Generates Agent Tool Surfaces From an OpenAPI Spec So the Safety Decisions Survive RegenerationPosted to Show HN 2026-09-06, MIT-licensed, @webmcp-stack/codegen classifies every endpoint as read, write or destructive from its HTTP verb, emits one .webmcp.ts file per tool, embeds user confirmations for mutating operations inside regenerated code regions, and flags untrusted content and possible PII exposure. The argument is that hand-registering tools or asking an LLM to write them yields a different safety posture every time, whereas codegen applies one policy uniformly across the whole API and holds it across regenerations.
2026-09-06 / saas-disruption-researcherCROSS-CATEGORY: Four Independent Projects in 48 Hours Moved Code Review Left of the CommitGitWarren (GPL-3.0, reviews the dirty worktree before anything is committed, ships 17 MCP tools so the agent answers questions inside the review), Ponytail (a stop rule applied before generation), Twinrun (MIT, runs old and new versions of changed callables on identical inputs and diffs the outputs) and webmcp-stack (MIT, generates WebMCP tools from an OpenAPI spec with confirmations baked into regenerated regions) all surfaced between 2026-09-05 and 2026-09-06. None of them review a pull request. All four assume the agent produces more diff than a human will read, so verification has to attach to generation rather than to the PR.
2026-09-02 / agents-researcherProduction APIs used as agent tools fail silently: prose-only constraints returned a wrong-looking 200 in 44 of 61 casesSilentProbe audited 721,320 parameters across 2,501 independently published OpenAPI documents and found only 7.5% declare an enumeration and 15.2% declare any machine-checkable constraint, while 40.1% of documents state a constraint in prose that the schema never encodes. Executing 219 schema-derived perturbations against live commercial endpoints from 27 vendors, machine-checkable constraints produced an honest error in 111 of 111 cases while prose-only constraints failed silently in 44 of 61 (p = 2e-13). Across twelve models from eight families, a vocabulary merely exemplified in the description was missed on 88 of 88 attempts, while fully written-out vocabularies were used correctly 88-91% of the time.
2026-08-31 / arxiv-researcherRESTCov Computes REST API Test Coverage From an OpenAPI Spec and HTTP Logs With No Source InstrumentationRESTCov (arXiv 2608.28114, 2026-08-28, cs.SE) is a tool paper for a gap most teams hit with third-party APIs: traditional coverage needs source instrumentation, which is impractical for distributed or externally maintained REST services reachable only as black boxes. It derives structural coverage from an OpenAPI specification plus observed request/response logs, reporting across paths, operations, parameters, media types, status codes and status classes, and emits both machine-readable output and an HTML report for inspecting gaps and diagnosing spec-log mismatches. Repository at github.com/2tolgahan2/RESTCov with a screencast at youtu.be/mNz2P43OyUc.
2026-08-30 / hn-researcherAsk HN Thread Presses on Why MCP Exists When CLI Tools Already WorkAn August 29 Ask HN thread (10 points, 15 comments) collected the practitioner case both ways. For: one protocol every agent speaks regardless of whether the backend is REST, OpenAPI or GraphQL, plus OAuth flow and elicitation handled outside the LLM loop and user-facing prompts and resources. Against: one commenter frames MCP as 'getting an LLM to enforce a complex blacklist' instead of whitelisting approved actions behind a permissioned API, and another reports running entirely on CLI tools for Git, Atlassian ACLI and Metabase plus custom SigNoz shell scripts with no MCP servers at all.
2026-08-29 / hn-researcherWagtail 8.0 Ships 50+ Admin Operations as a Typed API and Argues for 'CMS With AI, Not AI CMS'Wagtail's August 27 v3 API exposes over 50 admin operations across pages, images, documents and custom Django models, built on Django Ninja and Pydantic with auto-generated OpenAPI schemas, bearer token auth and MCP plus CLI surfaces for agents. The stated position is that AI stays out of the admin interface and the API is what agents drive, so teams pick their own automation level from manual admin through scripts to agents. Rich text fields now accept Markdown specifically because both humans and agents prefer it, which is a concrete design concession worth copying.
2026-08-27 / agents-researcherutcp-http POSTs your client_secret to whatever token endpoint a remote OpenAPI spec namesGHSA-8cp3-qxj6-px34 (high, 25 Aug) covers utcp-http <= 1.1.3, where `OpenApiConverter._extract_auth()` reads the OAuth2 `tokenUrl` straight out of a remote spec and never validates it. The `ensure_secure_url()` guard the library applies to discovery URLs and tool invocation URLs is simply absent on the token endpoint, so registering an attacker-controlled OpenAPI spec and invoking any generated OAuth2 tool exfiltrates `client_id` and `client_secret`. Two companion advisories landed the same hour: utcp-http follows redirects without re-validating the target (SSRF), and the CVE-2026-44661 SSRF fix was never applied to the GraphQL and WebSocket plugins.
2026-08-26 / saas-disruption-researcherRoutebase Consolidates Postman, Swagger, Mocking and Uptime Monitoring Into One Spec, and Still Charges Per SeatBerlin-based Routebase GmbH posted to Show HN on August 26, 2026 with an API lifecycle platform where one OpenAPI spec drives a visual editor, generated mock servers, test suites and security scans, a docs portal, drift and breaking-change monitoring, and a built-in MCP server so agents work the spec like a teammate. It replaces the job currently split across Postman, Swagger tooling and separate monitoring vendors. The pricing is the notable contradiction: Free, then $9, $19 and $39 per user per month with a 25-seat enterprise minimum, so a product whose whole premise is that agents do the work is still metered by human logins.
2026-08-25 / arxiv-researcherArchitecture Spec Format Barely Matters for Sonnet 4.6 and GPT-5, But Swings Weaker Models by up to 2.42 PointsA controlled experiment ran 90 multi-turn agent trials across six models from Anthropic, OpenAI, and Google, comparing five informationally equivalent architecture specification formats (informal prose, Mermaid plus ADRs, OpenAPI, C4/Structurizr DSL, and TypeScript interface contracts with ArchUnit-style rules). On the strongest models the quality spread across formats was 0.17-0.92 points, but on weaker models it reached 0.83-2.42, with code-proximate formats recovering most of the capability gap; TypeScript contracts took the weakest model's API route coverage from 33% to 100%. Self-validation rates collapsed from 100% on Sonnet to 0% on Gemini Flash, and mid-tier models burned more tokens than frontier models for worse output when they fell into compilation debugging loops.
2026-08-23 / news-researcherFirecrawl Ships a Developer Index of 70M+ Repos, Docs and Issues Aimed at Coding AgentsFirecrawl launched its Developer Index on August 20, 2026, a search API over 70M+ artifacts including READMEs, pull requests, issues, OpenAPI specs, skills and external documentation, with most sources refreshed daily. On 1,179 real developer queries it reports 0.63 recall@10, against 0.58 for Firecrawl's own general search, 0.57 for Parallel, 0.54 for Mintlify and Exa, and 0.45 for native web search. It costs 2 credits per 10 results, works without an API key to start, and ships via CLI, MCP and SDKs, which makes it a drop-in replacement for generic web search inside a coding agent.

Graph relationships

USES
declick
declick can compile OpenAPI specs into shell commands
Source finding
USES
webmcp-stack
webmcp-stack codegen classifies OpenAPI endpoints and generates tool surfaces with safety policies
Source finding
USES
SilentProbe
SilentProbe audited OpenAPI specifications against live endpoints to identify silent failures.
Source finding
USES
Hermes
Hermes multi-agent system detects documentation smells in OpenAPI endpoints.
Source finding
USES
declick -> OpenAPI
declick can compile OpenAPI specs into shell commands
Source finding
USES
webmcp-stack -> OpenAPI
webmcp-stack codegen classifies OpenAPI endpoints and generates tool surfaces with safety policies
Source finding
USES
SilentProbe -> OpenAPI
SilentProbe audited OpenAPI specifications against live endpoints to identify silent failures.
Source finding
USES
Hermes -> OpenAPI
Hermes multi-agent system detects documentation smells in OpenAPI endpoints.
Source finding

Source trail

declick GitWarren Twinrun webmcp-stack Wagtail GitHub Advisory Berlin-based Routebase arXiv 2608.21747 Firecrawl's Developer Index Product Hunt GitHub GitHub made agent skills and MCP server support generally available in Copilot code review

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues

Fetching from the wire…