What is this OpenAPI scanner page about?

The OpenAPI scanner performs local static analysis of OpenAPI JSON or YAML and reports structural risks before agents use the API. AgentReady is not a runtime firewall, independent certification, official standards-body standard or guaranteed-safety system. Community is free and available; Pro is planned and not purchasable.

AgentReady OpenAPI Scanner V1

Scan an OpenAPI spec before giving it to AI agents.

Upload an OpenAPI JSON or YAML file. The scan runs locally in your browser and generates an OpenAPI AgentReady Score, endpoint findings, a Markdown report, a printable report, and agentready.json.

What OpenAPI analysis covers before file selection

AgentReady performs static analysis of agent-facing OpenAPI contracts. It checks action type, destructive or external effects, missing confirmation boundaries, absent dry-run or preview paths, rollback and idempotency signals, sensitive data exposure, broad scopes and ambiguous agent instructions.

Runtime behavior and dynamically constructed capabilities may not be detectable. The scanner does not call API endpoints.

Reproducible OpenAPI exampleagentready-examples/commercial/openapi-refund-risk.bad.json

AgentReady Score

Policy FAIL

1Critical

4High

6Medium

0Low

AR001_UNBOUNDED_WRITE_ACTION

A refund operation can change state without a clear confirmation boundary or bounded rollback path.

node bin/agentready.js scan openapi agentready-examples/commercial/openapi-refund-risk.bad.json --min-score 75 --fail-on critical

Fixed fixture: agentready-examples/commercial/openapi-refund-risk.fixed.json returns score 84 and policy PASS with the same engine.

Upload OpenAPI JSON or YAML

Supports OpenAPI 3.0 / 3.1 in .json, .yaml, and .yml.

YAML note: YAML support is static and best-effort. Complex anchors, merge keys, or vendor-specific YAML constructs may need conversion to JSON before scanning.

Large spec note: local V1 analysis rejects files above the configured browser safety limit. Split very large OpenAPI specs by domain or export a reduced public-agent surface.

Drop your OpenAPI file here

No submitted API endpoint is called. The file is not uploaded by this static page.

Printable OpenAPI AgentReady Report

TimeProofs AgentReady OpenAPI Report

Executive summary

Recommended action plan

Risk summary

Common fix examples

Severity guide

AgentReady contract

This scan generated a machine-readable agentready.json contract containing agentready_version, generated_at, source_type, source metadata, operation risk levels, detected risks, and agent recommendations.

Markdown report

Limitations

TimeProofs AgentReady does not guarantee that an AI agent will never fail. It identifies structural risks that may cause AI agents to misuse APIs, tools or MCP servers.

AgentReady at a glance

The OpenAPI scanner performs local static analysis of OpenAPI JSON or YAML and reports structural risks before agents use the API. AgentReady is a product and candidate open standard for static pre-deployment analysis. It is not a runtime firewall, independent certification, official standards-body standard or guaranteed-safety system.

Availability: AgentReady Community is free and available. AgentReady Pro is planned and not purchasable.
Language: English is the current canonical language. No translated alternate route is published for this page.

Sources

AGENTREADY_MASTER_PLAN.md GLOBAL_STANDARD_SITE_PROGRAM.md SEO_GEO_AI_FIRST_REQUIREMENTS.md SITE_COPY_GUIDE.md SITE_GLOBAL_DEVELOPER_DOCS_FOUNDATION_EVIDENCE.md