Live 62 Actions

Swagger MCP Server
for AI Agents

Q: What AI frameworks and AI clients does the StackOne Swagger MCP server support?

The StackOne Swagger MCP server supports both. MCP clients (paste-and-go apps): Claude Desktop, Claude Code, Cursor, VS Code, Goose. Agent frameworks (code SDKs you build with): OpenAI Agents SDK, Anthropic, Vercel AI, Google ADK, CrewAI, Pydantic AI, LangChain, LangGraph, Azure AI Foundry.

Connect your AI agent to StackOne's Swagger MCP server and give it 62 MCP tools out of the box. Auth, tool execution, and security all managed.

Start Free Book Demo Read Docs →

Swagger MCP Server

Built by

StackOne

Coverage

62 Agent Actions

Create, read, update, and delete across Swagger — and extend your agent's capabilities with custom actions.

MCP Actions → Build Actions →

Authentication

Agent Tool Authentication

Per-user OAuth in one call. Your Swagger MCP server gets session-scoped tokens with zero credentials stored on your infra.

Agent Auth →

Security

Agent Protection

Every Swagger tool response scanned for prompt injection in milliseconds — 88.7% accuracy, all running on CPU.

Prompt Injection Defense →

Performance

Max Agent Context. Min Cost.

Free up to 96% of your agent's context window to enhance reasoning and reduce cost, on every Swagger call.

Tools Discovery →

What is the Swagger MCP Server?

A Swagger MCP server lets AI agents read and write Swagger data through the Model Context Protocol — Anthropic's open standard for connecting LLMs to external tools. StackOne's Swagger MCP server ships with 62 pre-built actions, fully extensible via the Connector Builder — plus managed authentication, prompt injection defense, observability, and agent execution runtime. Connect it from MCP clients like Claude Desktop, Claude Code, Cursor, Goose, and VS Code, or from agent frameworks like OpenAI Agents SDK, LangChain, and Vercel AI SDK.

All Swagger MCP Tools

Every action from Swagger's API, ready for your agent. Create, read, update, and delete — scoped to exactly what you need.

API Versions

Clone API Version
Clone a specific API version into a new API owned by the caller. Cloning copies the definition so it can be modified independently of the source.
Get API Versions
Retrieve the list of versions for a specific API, returned as an OpenAPI-style document whose entries reference each published version. Use List Owner APIs first to get the owner and API name.
Delete API Version
Delete a single version of an API, leaving other versions intact. Provide the owner, API name and the version to remove.

Attachments

List Attachments
List all attachments belonging to a SwaggerHub Portal or to a specific product. Filter by either a portal ID or a product ID (the two filters are mutually exclusive).
Get Attachment
Retrieve the metadata for a single attachment by its ID, including its name, content type and visibility. Use List Attachments to find attachment IDs.

Documents

Get Document
Retrieve the content and metadata of a portal document by its id. A document is the content body behind a table-of-contents entry — the documentId is referenced from a section's table of contents entries (see Get Section Table of Contents).
Update Document
Update the contents of a portal document by its id. Provide the document object with the fields to change (e.g. content, type, source). The documentId is referenced from a section's table of contents entries (see Get Section Table of Contents).

Domain Versions

Get Domain Versions
Retrieve the list of versions for a specific domain, returned as an OpenAPI-style document whose entries reference each published version. Use List Owner Domains first to get the owner and domain name.
Delete Domain Version
Delete a single version of a domain, leaving other versions intact. Provide the owner, domain name and the version to remove. If the version is referenced by other APIs or domains, set force to true or the delete is rejected.

API Integrations

Create API Integration
Configure a new integration for a specific API version by posting an integration configuration object. The integration type is determined by the configType field inside the configuration. The integration name must be unique for the API version.
List API Integrations
List all integrations configured for a specific API version, including their integration types, names, unique IDs and enabled/disabled status. Use Get API Versions to obtain the owner, API name and version.
Get API Integration
Retrieve the full configuration of a single integration for an API version by its ID. Access tokens and passwords are omitted from the response for security. Use List API Integrations to obtain the integration ID.
Update API Integration
Replace the configuration of an existing integration for an API version. Provide the full integration configuration object; the configType cannot be changed. Use List API Integrations to obtain the integration ID.
Delete API Integration
Delete an existing integration from an API version by its ID. This cannot be undone. Use List API Integrations to obtain the integration ID.

Portals

Create Portal
Create a new SwaggerHub portal. Requires a subdomain and the swaggerHubOrganizationId (the owning organization's UUID). Note — swaggerHubOrganizationId is NOT returned by any action in this connector; copy it from Swagger Studio (app.swaggerhub.com) organization settings or the organization page URL. It is a UUID, not the organization handle/name.
List Portals
List the SwaggerHub portals the caller can access, with optional subdomain filtering and paging. Returns a paged list of portals with their id, name, subdomain and settings.
Get Portal
Retrieve a single SwaggerHub portal by its id. Optionally embed related resources. Use List Portals first to get the portalId.
Update Portal
Update an existing SwaggerHub portal by its id. Provide the portal object with the fields to change. Use List Portals first to get the portalId.
Delete Portal
Soft delete a SwaggerHub portal by its id. Use List Portals first to get the portalId.

Portal Products

Create Portal Product
Create a new product within a SwaggerHub portal. The `type` field is a discriminator — set it to 'new' to create a fresh product (send name + slug, do not send productId/templateId) or 'copy' to clone an existing product (productId is REQUIRED, templateId optional). Use List Portals first to get the portalId.
List Portal Products
List the products published in a specific SwaggerHub portal, with optional name/slug filtering and paging. Use List Portals first to get the portalId.

Portal Templates

Create Portal Template
Create a new documentation template within a SwaggerHub portal. Provide the template object (e.g. name, description). Use List Portals first to get the portalId. These portal documentation templates are distinct from Registry API templates (see List Templates).
List Portal Templates
List the documentation templates available in a specific SwaggerHub portal, with optional name filtering and paging. Use List Portals first to get the portalId.
Get Portal Template
Retrieve a single SwaggerHub Portal template by its ID. Portal templates define reusable documentation layouts and are distinct from Registry API templates (List Templates). Use List Portal Templates (under a known portalId) to obtain the templateId. Optionally embed related resources.
Update Portal Template
Update the details of a SwaggerHub Portal template. Only the properties supplied in the template body are modified (partial update). Use List Portal Templates to obtain the templateId, and Get Portal Template to inspect current values first. This targets Portal templates, not Registry API templates.
Delete Portal Template
Soft-delete a SwaggerHub Portal template by its ID. The template is marked as removed rather than permanently erased. Use List Portal Templates to obtain the templateId. This targets Portal templates, not Registry API templates.

Products

Get Product
Retrieve a single SwaggerHub Portal product by its ID, optionally embedding related resources. A product is a portal-facing documentation product that groups published API content. Use List Portal Products (under a known portalId) to obtain the productId.
Update Product
Update an existing SwaggerHub Portal product. Provide the product ID and a product object with the fields to change (partial update). Use List Portal Products to obtain the productId.
Delete Product
Soft delete a SwaggerHub Portal product by its ID. The product is removed from the portal but can typically be restored by SwaggerHub support. Use List Portal Products to obtain the productId.

Projects

Create Project
Create a new project for a user or organization, optionally including a set of APIs and domains that belong to the same owner. Projects group related APIs and domains together.
List Projects
List all projects belonging to a specific owner (organization or user) in SwaggerHub, with optional name-only responses and pagination. Projects group related APIs and domains together. Provide the owner handle.
Get Project
Retrieve a single project by owner and project name, including its included APIs and domains. Use List Projects first to find the owner and project name.
Update Project
Update an existing project's data (description and the set of included APIs and domains). Properties that are not provided are reset to empty values, so send the full desired project state.
Delete Project
Permanently delete a project by owner and project name. This removes the project grouping only; the underlying APIs and domains are not deleted.

Table Of Contents Entrys

Update Table Of Contents Entry
Update a table of contents entry by its id. Provide the fields to change (e.g. slug, title, order, parentId, content, status). Use Get Section Table of Contents first to get the tableOfContentsId.
Delete Table Of Contents Entry
Delete a table of contents entry by its id. Optionally delete all nested entries recursively. Use Get Section Table of Contents first to get the tableOfContentsId.

Templates

List Templates
List the API templates available in SwaggerHub, including the built-in templates. Provide the owner handle (username or organization name) to additionally include that owner's own templates on top of the always-present built-ins.
Delete Template
Permanently delete an entire template (all of its versions) owned by a user or organization. This cannot be undone.

Other (24)

Create Or Update API
Create a new API or save a new/updated version of an existing API by posting an OpenAPI definition. The version is taken from the definition's info.version unless overridden, and the API can be marked private. Use force to overwrite an existing version.
Create Or Update Domain
Create a new domain or save a new/updated version of an existing domain by posting a domain definition. The version is taken from the definition's info.version unless overridden, and the domain can be marked private. Use force to overwrite an existing version.
Add API Or Domain To Project
Add an existing API or domain to a project. Specify whether the definition is an API or a domain and its name; it must belong to the same owner as the project.
Create Section Table Of Contents Entry
Add a table of contents entry to a portal section. Provide the entry as an object (a new entry or a copy of an existing one). Use Get Section first to get the sectionId.
Create Or Update Template
Create a new template or save a new/updated version of an existing template by posting a template definition. The version is taken from the definition's info.version unless overridden, and the template can be marked private. Use force to overwrite an existing version.
List Owner APIs
List all API definitions owned by a specific user or organization in SwaggerHub, with pagination and sorting. Use the owner handle (username or organization name).
Get API Definition
Retrieve the OpenAPI/Swagger definition for a specific API version as JSON. Optionally resolve external references or flatten the definition. Get the owner, API name and version from Get API Versions.
Get API Standardization
Run the organization's standardization (API governance) rules against a specific API version and return the violations found. Use this to check an API against style and governance policies.
Get API Validation
Retrieve the validation results (errors and warnings) for a specific API version, reflecting how well the definition conforms to the OpenAPI specification. Requires API standardization/validation to be configured for the owner organization — returns 404 if no validation is set up for the org.
List Owner Domains
List all domain definitions owned by a specific user or organization in SwaggerHub, with pagination and sorting. Use the owner handle (username or organization name).
Get Domain Definition
Retrieve the OpenAPI/Swagger domain definition for a specific domain version as JSON. Get the owner, domain name and version from Get Domain Versions.
List Portal Access Requests
List the access requests submitted for a specific SwaggerHub portal, with optional status filtering, search and paging. Use List Portals first to get the portalId.
Get Product Sections
List the sections of a SwaggerHub Portal product, with optional embedding of related resources and pagination. Sections organize the product's content and table of contents. Use List Portal Products to obtain the productId; the returned section ids feed Get Section and Get Section Table of Contents.
Search Published Content
Full-text search across a product's published portal content. Provide a search query (3-255 chars) and optionally filter by result type (DOCUMENT, API, OPERATION, SCHEMA) and paginate the results. Use List Portal Products to obtain the productId. Only PUBLISHED content is searched.
Get Project Members
List the users and teams that are members of a project. Returns each member's name and type (USER or TEAM). Only works for projects owned by an organization — projects under a personal owner return 404.
Get Section
Retrieve a specific portal section by its id, including its metadata. Optionally embed related resources such as its table of contents. Use Get Product Sections (get_product_sections) first to get the sectionId.
Get Section Table Of Contents
List the table of contents entries for a specific portal section, with pagination. Optionally embed related resources. Use Get Section first to get the sectionId.
Search APIs And Domains
Search across all APIs, domains and templates in SwaggerHub in APIs.json format, with optional filters for spec type, visibility, publication state and owner plus free-text query, pagination and sorting. Returns a paged APIs.json result.
Get Template Versions
Retrieve the APIs.json listing of all versions for a specific template, identified by its owner and template id. Use List Templates first to get the owner and template id.
Set API Default Version
Set the default version for an API. Provide the version identifier to make default.
Delete API
Permanently delete an entire API (all of its versions) owned by a user or organization. This cannot be undone — use Delete API Version to remove a single version instead.
Delete Domain
Permanently delete an entire domain (all of its versions) owned by a user or organization. This cannot be undone — use Delete Domain Version to remove a single version instead. If the domain is referenced by other APIs or domains, set force to true or the delete is rejected.
Fork API Version
Fork a specific API version, creating a linked copy that tracks its origin. Use fork (rather than clone) when you want to preserve the relationship to the source API.
Fork Template Version
Fork a specific template version into a new template, creating a linked copy that tracks its origin. Provide the target account, new name and version for the fork.

Set Up Your Swagger MCP Server in Minutes

One endpoint. Any framework. Your agent is talking to Swagger in under 10 lines of code.

MCP Clients

Agent Frameworks

Claude Desktop-

JSON

Claude Desktop Docs

{
  "mcpServers": {
    "stackone": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote@latest",
        "https://api.stackone.com/mcp?x-account-id=<account_id>",
        "--header",
        "Authorization: Basic <YOUR_BASE64_TOKEN>"
      ]
    }
  }
}

Platform Resources

MCP Code Mode: Keeping Tool Responses Out of Agent Context

Anthropic's code_execution processes data already in context. Custom MCP code mode keeps raw tool responses in a sandbox. 14K tokens vs 500.

11 min

Comparing BM25, TF-IDF, and Hybrid Search for MCP Tool Discovery

Benchmarking BM25, TF-IDF, and hybrid search for MCP tool discovery across 916 tools. The 80/20 TF-IDF/BM25 hybrid hits 21% Top-1 accuracy in under 1ms.

10 min

Indirect Prompt Injection Defense for MCP Tools: A Technical Guide

MCP tools that read emails, CRM records, and tickets are indirect prompt injection vectors. Here's how we built a two-tier defense that scans tool results in ~11ms.

12 min

MCP vs A2A: Architecture, Security, and When to Use Each

MCP vs A2A: what each protocol standardizes, how they differ, their shared security risks including indirect prompt injection, and when to use one, both, or a hybrid architecture.

12 min

MCP vs API: What Hundreds of Connector Builds Taught Us

MCP wraps APIs, it doesn't replace them. After building hundreds of connectors that serve both, here's when each approach wins.

14 min read

Swagger MCP Server FAQ

Does StackOne have a Swagger MCP server?

Yes. StackOne offers a hosted Swagger MCP server with 62 pre-built actions, and every action is tested and QA'd by StackOne. Connect it to Claude, Cursor, and any other MCP client, or to any agent framework through the AI Action SDK. It ships with managed agent authentication, prompt injection defense, and tool discovery with server-side execution that preserve your agent's context window and keep reasoning performance.

Swagger MCP server vs direct API integration — what's the difference?

A Swagger MCP server and direct API integration serve different use cases. Direct API integration is for software-to-software — backend code calling Swagger. A Swagger MCP server is for AI agents — MCP clients like Claude and Cursor, plus framework agents built with OpenAI, LangChain, or Vercel AI — discovering and calling Swagger at runtime. StackOne provides both.

How does Swagger authentication work for AI agents?

Swagger authentication for AI agents works through a StackOne Connect Session. Create one via the dashboard or the SDK — you get an auth link and ready-to-paste config for Claude Desktop, Cursor, and other MCP clients. Your user authenticates their own Swagger account; StackOne handles token exchange, storage, and refresh. Credentials never reach the LLM, and each user is isolated via origin_owner_id.

Are Swagger MCP tools vulnerable to prompt injection?

Yes — Swagger MCP tools can be vulnerable to indirect prompt injection. Any tool that reads user-written content — documents, messages, tickets, records, or free-text fields — is a potential vector. StackOne Defender scans every tool response before it enters the agent's context — regex patterns in ~1ms, then a MiniLM classifier in ~4ms. 88.7% accuracy, CPU-only.

What is the context bloat of a Swagger agent and how do I avoid it?

Context bloat happens when Swagger tool schemas and API responses eat your Swagger agent's memory, preventing it from reasoning effectively. A single Swagger query can return a massive JSON response, and connecting multiple tools compounds the problem. Tools Discovery and Code Mode reduce context bloat — loading only relevant tools per query and keeping raw responses out of the agent's context.

Can I limit which actions my Swagger agent can access?

Yes — you can limit which actions your Swagger agent can access directly from the StackOne dashboard. Toggle actions on or off, or restrict them to specific accounts, with no code changes to your agent. Session tokens can be scoped to exact actions so if one leaks, exposure stays contained.

Can I create custom agent actions for my Swagger MCP server?

Yes — you can create custom agent actions for your Swagger MCP server using Connector Builder. It's an integration agent your coding assistant (Claude Code, Cursor, or Copilot) can invoke to research Swagger's API, generate production-ready connector YAML, test against the live API, and validate before you ship.

When should I NOT use a Swagger MCP server?

Skip a Swagger MCP server if your integration is purely software-to-software — direct Swagger API integration is simpler when no AI agent is involved. For deterministic, compliance-critical operations (financial transactions, regulatory reporting), direct API gives you predictable behavior without agent-driven decision-making. MCP shines when AI agents need to dynamically discover and call Swagger actions at runtime.

What AI frameworks and AI clients does the StackOne Swagger MCP server support?

The StackOne Swagger MCP server supports both. MCP clients (paste-and-go apps): Claude Desktop, Claude Code, Cursor, VS Code, Goose. Agent frameworks (code SDKs you build with): OpenAI Agents SDK, Anthropic, Vercel AI, Google ADK, CrewAI, Pydantic AI, LangChain, LangGraph, Azure AI Foundry.

Put your AI agents to work

All the tools you need to build and scale AI agent integrations, with best-in-class connectivity, execution, and security.

Start Free Book Demo

Swagger MCP Serverfor AI Agents