Swagger
by Swagger
Design, govern and publish APIs and developer portals from an AI agent. Anthropic lists 22 tools; SmartBear's source and docs enumerate 38. Publishing goes live by default, and one tool pair issues arbitrary HTTP requests.
Verified connector
Listed by Anthropic as a partner connector in its Connectors Directory.
Connection checked by Agentman on .
Anthropic states this reflects the level of review a connector received, not a security audit.
Connect Swagger via MCP
https://swagger.mcp.smartbear.com/mcpWorks in any MCP-compatible client. In Agentman Studio it is one click — no config file to edit.
Swagger Tools & Capabilities (38)
Tool names from Anthropic's directory listing. This server requires sign-in, so we could not read tool descriptions or parameter schemas.
Limits
- The OAuth scopes are identity claims only. SmartBear's authorization server advertises
openid,profile,emailandoffline_access. No boundary falls between reading an API definition and publishing a portal or deleting a product — the consent screen cannot express the difference. The server's RFC 9728 descriptor names the authorization server and declares noscopes_supportedat all. - Anthropic's listing is stale by 16 tools. The directory's 22 names are a clean subset of SmartBear's 38, but a reader sizing the surface from the listing will underestimate it, and the omissions include
patch_apiand the entire outbound-request path. - We did not read the live server's tool list. The endpoint returned 401 to an anonymous request, so the 38 tools and their annotations come from SmartBear's open-source repository at release v0.37.0, dated 2026-08-20. The remote deployment may register a different subset — the source supports filtering by toolset through configuration, and the repository is the multi-product server rather than the Swagger-only remote build. Treat 38 as the documented surface, not a live count.
- Tool names carry no prefix here. The open-source code derives names as
swagger_plus the lower-cased title. The directory and SmartBear's own Swagger documentation both use the unprefixed form, which is what this page uses. - Publishing is live unless the agent asks otherwise.
previewdefaults to false. - Overwriting is the default for AI fixes.
standardize_apiandpatch_apiboth overwrite the current version unless a new version is supplied. - Functional Testing tools issue arbitrary HTTP requests. They are gated on a separate token and absent without it. With it,
create_testplusrun_testis a general-purpose HTTP client with attacker-controllable URL, method, headers and body. - AI calls have no published rate and no accounting tool. Nothing in the surface can observe what an AI generation or standardisation costs before or after the call.
- Content-type combinations are restricted. SmartBear documents that external HTML documents cannot be edited through the API, and that one source-and-type combination returns an error when creating a page with content.
- The documentation URL fails without cookies. Anthropic's nominated doc URL redirects into a silent-login loop that exhausts 50 redirects for a plain client; it returns 200 with a cookie jar. A previous check recorded this connector as having dead documentation. The server and the docs are both live — the failure was in the fetch, not the vendor.
- The documentation page is JavaScript-rendered. A text extractor recovers 1,026 words of navigation chrome and no content. The prose lives in a React Router data payload served from the same path with a
.datasuffix, which is where the tool tables on this page come from.
Frequently asked questions
Yes, and that is its default behaviour. The publish_portal_product tool takes a preview boolean that SmartBear's source defaults to false, meaning live publication. A single call makes a product's current draft content visible to portal visitors. Preview mode exists but the agent has to ask for it, so an unqualified instruction publishes.
Yes, through the Functional Testing tools. SmartBear documents that create_test accepts request steps with URL, HTTP method, headers and body, and run_test executes them. There is no allowlist tying a test to your own APIs. This makes the verb census misleading, because two tools reach any host the runner can route to.
Thirty-eight, not the 22 Anthropic's directory lists. SmartBear's open-source repository defines 27 Swagger tools plus 11 Functional Testing tools at release v0.37.0. The directory's 22 names all appear in that set, so nothing is fabricated, but five Swagger tools and all 11 testing tools are missing from the listing.
Four scopes, none of which narrow anything. SmartBear's authorization server at auth.swaggerhub.com advertised openid, profile, email and offline_access on 2026-08-22. All four are OpenID identity claims. Nothing at the OAuth grant separates reading an API definition from publishing a portal or deleting a product.
Yes, two tools delete. delete_portal_product removes a product from a portal, and delete_table_of_contents removes a navigation entry. SmartBear documents that the second is a soft delete that also removes the associated document content, and that it supports recursive deletion of nested items via a recursive flag.
Yes, unless you pass a new version. SmartBear documents that standardize_api sends findings to SmartBear AI, saves the corrected definition back to the registry, and that omitting the newVersion argument overwrites the current version. The docs recommend supplying a patch bump instead. The same overwrite applies to patch_api.
Whatever network the tunnel is deployed into. SmartBear's schemas accept a tunnelAgentName on both suite creation and suite runs, overriding each test's saved tunnel. A tunnel agent exists to reach APIs that are not publicly routable, so a test run through one reaches internal hosts your agent could not otherwise call.
Because its cached OAuth dynamic client registration expired. SmartBear's troubleshooting page names the error as unknown or expired client_id and gives the fix: open the Command Palette, run Authentication Remove Dynamic Authentication Providers, remove the stale provider, then restart VS Code and sign in again. SmartBear links VS Code issue 250960.
Sources
- SmartBear MCP Server, "Swagger Remote Server" (retrieved 2026-08-22) · retrieved 2026-08-22
- SmartBear MCP Server, "Swagger Portal Integration" (retrieved 2026-08-22) · retrieved 2026-08-22
- SmartBear MCP Server, "Swagger Studio Integration" (retrieved 2026-08-22) · retrieved 2026-08-22
- SmartBear MCP Server, "Swagger Functional Testing Integration" (retrieved 2026-08-22) · retrieved 2026-08-22
- SmartBear MCP Server, "Troubleshooting" and "Best Practices" — · (retrieved 2026-08-22) · retrieved 2026-08-22
- SmartBear MCP Server source, release v0.37.0, commit
d0e2df7(retrieved 2026-08-22). Tool definitions and safety annotations read fromsrc/swagger/client/tools.ts,src/swagger/client/tool-constants.ts,src/swagger/client/portal-types.ts,src/swagger/client/registry-types.tsandsrc/swagger/client/functional-testing-types.ts. · retrieved 2026-08-22 - Live auth posture check: anonymous initialize returned HTTP 401 with a
www-authenticateOAuth challenge naming the resource metadata document (2026-08-22) · retrieved 2026-08-22 - RFC 9728 resource metadata (retrieved 2026-08-22). A nonsense control path on the same host returned 404, so the 200 is a real descriptor rather than a catch-all. · retrieved 2026-08-22
- SwaggerHub authorization server metadata (retrieved 2026-08-22) · retrieved 2026-08-22
- Anthropic Connectors Directory entry — , read from our directory snapshot dated 2026-08-16 · retrieved 2026-08-16
- SmartBear support — · Privacy
Use in Agentman
Connect once and your agents call these tools on their own — on a schedule, in a workflow, with nobody at the keyboard.
Open in Agentman StudioServer Info
- Category
- Developer Tools
- Developer
- Swagger
- Tools
- 38
- Domain
- swagger.mcp.smartbear.com
Using Claude Desktop or another MCP client? Setup docs — the connection URL above works anywhere.