Sourced*

Agents

OpenAPI agent-readiness report

· 2 min read · Sourced

  • openapi
  • agents
  • safety
  • mcp

An agent-readiness report answers a narrow question:

Can this OpenAPI spec safely become a tool surface for agents?

Sourced generates the report before install snippets, repo writes, directory submissions, or production rollout. It is the pause between "the generator can do this" and "a model can be allowed to call it."

What to count

Start with operation safety:

  • read tools
  • sensitive read tools
  • write tools
  • destructive tools

Then add quality checks:

  • total tool count
  • missing or synthesized operation IDs
  • vague descriptions
  • non-public API base URLs
  • authenticated HTTP URLs
  • OAuth/OpenID Connect setup blockers
  • query-string API keys

Sourced shows these checks in the UI and includes them in generated files.

What blocks remote setup

Block remote connector output when:

  • there is no public HTTPS MCP endpoint
  • DNS resolves to private or reserved addresses
  • the upstream API base URL is not public
  • the upstream API uses auth over plain HTTP
  • OAuth needs consent/callback/token storage review
  • the API uses auth and the MCP endpoint is not protected
  • there are no safe tools for a default allowlist

A blocked state is good UX if it says exactly what to fix. A vague "not ready" is just another support ticket.

What stays out of defaults

Default-enabled tools usually exclude:

  • API key reads
  • user and member inventories
  • exports
  • billing data
  • write actions
  • destructive actions
  • admin-only endpoints

This does not mean those tools can never be exposed. It means the first connector stays narrow enough for an API owner to approve it confidently.

What the report generates

Sourced's report ships in two forms:

  • a UI panel on the generator page
  • agent-readiness.md inside the Agent Interface Pack

The pack also includes adapter.ir.json and adapter.manifest.json, so tests can assert that the manifest, safety counts, and default allowlist match the parsed OpenAPI operations.

Why this helps SEO and sales

Agent connector buyers are not searching for generic "AI integrations." They are searching for concrete jobs:

  • "generate MCP server from OpenAPI"
  • "OpenAPI to ChatGPT connector"
  • "Grok Bot MCP server generator"
  • "Claude MCP connector from OpenAPI"
  • "MCP tool safety checklist"

An agent-readiness report turns those searches into a real product artifact. It gives the visitor something to upload, review, and approve.

Run an agent-readiness report.