petstore3.swagger.io

openapiverified2026-09-18 14:53:51Z153ms

No hijack patterns, 3 items worth a human look.

sharepost on x share on linkedin hacker news reddit

your watchlist lives on the leaderboard →

what checked out

HTTPS enforced
Machine-readable spec found (https://petstore3.swagger.io/api/v3/openapi.json)
Auth declared in spec

Check every tool before you connectdon't let this happen again

Add one block, every session is guarded

Paste into claude_desktop_config.json (Settings → Developer → Edit Config), then restart Claude Desktop.

{
  "mcpServers": {
    "toolproof": {
      "command": "npx",
      "args": ["-y", "toolproof-mcp"]
    }
  }
}

The guard calls the same verdicts you just saw. No account, no key — and it never sends your conversations anywhere.

findings · 3

mediumTP-103Outbound URL in tool text

spec.info

https://swagger.io](https://swagger.io  ·  https://github.com/swagger-api/swagger-petstore  ·  https://github.com/swagger-api/swagger-petstore/blob/master/src/main/resources/openapi.yaml

Verify every URL: tool text that names endpoints can steer agents into contacting attacker infrastructure.

fix Remove the URLs, or document each one in your README. If the tool must call out, do it in code, not in text the model reads.

mediumTP-304Credential-shaped parameter

DELETE /pet/{petId} → api_key

api_key

Credentials in query/path parameters leak into logs, referrers and agent transcripts.

fix Take credentials out of parameters — use environment config or an auth header the harness controls.

mediumTP-304Credential-shaped parameter

GET /user/login → password

password

Credentials in query/path parameters leak into logs, referrers and agent transcripts.

fix Take credentials out of parameters — use environment config or an auth header the harness controls.

passport · canonical JSON

{
  "v": 1,
  "kind": "openapi",
  "target": "https://petstore3.swagger.io/api/v3",
  "host": "petstore3.swagger.io",
  "state": "verified",
  "scannedAt": "2026-09-18T14:53:51.028Z",
  "score": 64,
  "grade": "C",
  "summary": "No hijack patterns, 3 items worth a human look.",
  "findingCounts": {
    "critical": 0,
    "high": 0,
    "medium": 3,
    "low": 0,
    "info": 0
  },
  "ruleIds": [
    "TP-103",
    "TP-304"
  ],
  "positives": [
    "HTTPS enforced",
    "Machine-readable spec found (https://petstore3.swagger.io/api/v3/openapi.json)",
    "Auth declared in spec"
  ],
  "scanner": {
    "name": "toolproof",
    "version": "0.1.0"
  }
}

consume as JSON

curl "{origin}/api/v1/verify?target=https%3A%2F%2Fpetstore3.swagger.io%2Fapi%2Fv3\&kind=auto" | jq

The verify endpoint returns the passport above plus an ed25519 signature over its canonical form. Verify offline with the public key.

Verification code →

badge

<img src="{origin}/api/v1/badge?target=https%3A%2F%2Fpetstore3.swagger.io%2Fapi%2Fv3\&kind=auto">

embed

<iframe src="https://toolproof-scan.vercel.app/embed?target=https%3A%2F%2Fpetstore3.swagger.io%2Fapi%2Fv3&kind=auto" style="border:0;width:340px;height:260px;border-radius:12px" loading="lazy"></iframe>

The live verdict card, framable on any site. It scans on load and links back to this full card.

← scan something else re-scan