Validate the OpenAPI document
Check version, metadata, paths, operations, and incomplete operation descriptions.
Validate OpenAPIAPI and MCP review
Inspect the contract before customers find the gaps.
Use these browser tools to review API structure, version changes, webhook payloads, MCP capabilities, write exposure, and OAuth readiness before an integration reaches production.
- Input
- OpenAPI JSON, manifests, payloads, scopes, or configuration text.
- Processing
- Runs locally in this browser.
- Purpose
- Find review items; do not silently alter a live interface.
Release review
Check the interface from contract to authorization.
These checks separate documentation quality, change risk, and permission risk so a clean schema is never mistaken for a secure deployment.
Compare contract versions
Review additions, removals, and changed interface elements before replacing a published contract.
Compare versionsInventory endpoints
Produce a concise endpoint list for ownership, documentation, and release review.
Build endpoint inventoryValidate webhook payloads
Check a payload against the shape an integration expects before wiring the receiver.
Validate a payloadReview MCP permissions
Flag capability language and scopes that imply writes, deletion, execution, or broad access.
Analyze MCP permissionsCheck OAuth readiness
Review the expected authorization pieces before claiming an MCP server is ready for protected customer use.
Check OAuth readinessPractical boundaries
Three separate release decisions.
A service can be well documented and still have unsafe authorization. It can also be secure and still break a customer integration through an unreviewed contract change.
Contract quality
Are paths, operations, schemas, errors, and version behavior clear enough for a consumer to implement correctly?
Authorization boundary
Does each identity receive only the products, tools, data scopes, and write actions it is entitled to use?
Operational behavior
Are retries, idempotency, rate limits, errors, and webhook delivery observable and recoverable?
Use your own AI
Repeatable MCP and AI checks, without a hosted model.
Developer Assurance Kit compares complete MCP catalogs and checks recorded AI runs against expected schemas, exact values, source quotes and your cost/latency budgets. The browser preview supports five cases; the $79 one-time edition adds 100 cases, offline use, CLI, SDK, private CI and five local MCP tools.
Source quotes are checked for exact membership, not semantic truth. Tool annotations are not permissions. No live server execution, AI inference or security certification.
Go beyond a valid webhook payload.
Use the free webhook delivery and replay analyzer to inspect recorded retries, missing events, duplicate business effects and incomplete telemetry. Export source-hashed evidence or use the same engine through the offline Node CLI. No endpoint is contacted and no event is replayed.
Keep release evidence together.
Follow the MCP catalog diff workflow, prepare AI regression fixtures, then inspect matched case outcomes, cohorts, cost and latency. The AI developer-tool hub separates the free tools from the licensed developer software.
Test tool permissions as explicit cases.
The free MCP tool policy tester compares expected allow, deny and approval-required decisions with supplied roles, exact scopes and environment rules. Keep negative tests and untested tools visible, or run the same engine with the free offline CLI. This is policy simulation, not token validation or live access enforcement.
Need product data in your own workflow?
Elkwai Solutions also offers scoped API and OAuth-protected MCP product delivery with versioned contracts, customer entitlements, usage boundaries and account-managed credentials. Product access and local assurance software are separate offers, not duplicate access fees.