Recategorise SpecShield: add security and mcp, drop misc - #818
Merged
mbifulco merged 1 commit intoAug 23, 2026
Conversation
SpecShield ships an OWASP rule pack that flags attack vectors in an OpenAPI description (non-HTTPS servers, missing security field, credentials in query strings, HTTP Basic), which matches the Security category. It also publishes an MCP server, which matches the MCP category. With those two added, misc is no longer needed.
specshield26
requested review from
AlexanderKaran,
mbifulco and
philsturgeon
as code owners
August 23, 2026 09:40
✅ Deploy Preview for openapi-dot-tools ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
mbifulco
approved these changes
Aug 23, 2026
mbifulco
left a comment
mbifulco
left a comment
Member
There was a problem hiding this comment.
appreciate the follow-up, lgtm!
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #816 — thanks for merging that one.
Having read the category descriptions properly, two of them fit SpecShield better than
miscdoes:security— "By poking around your OpenAPI description, some tools can look out for attack vectors you might not have noticed."SpecShield ships an OWASP rule pack that checks exactly this in the description: non-HTTPS servers, missing
securityfield, credentials passed in query strings, and HTTP Basic auth.mcp— "Tools that generate or work with Model Context Protocol (MCP) servers."SpecShield publishes one, on npm and the MCP registry, so an AI agent can run the compatibility and governance checks before opening a PR.
With those two added,
miscisn't needed any more — happy to keep it if you'd rather, it just seemed redundant given the description says it's for things that "hasn't quite got enough to warrant its own category."schema-validatorsis unchanged.One category I deliberately did not add:
testing. Its description is about executing API requests and validating responses at runtime, and SpecShield doesn't do that — it compares descriptions statically. Flagging it in case it looked like an obvious omission.