com.redocly/mcp

Est-ce que com.redocly/mcp est sûr ?

Au dernier audit MCP Hub, le serveur MCP « com.redocly/mcp » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 3 outils

• discover≈ 305 tokens

  Get the exact TypeScript signatures of the sandbox functions that `execute` scripts can call. Analyze the user request first, then pass `names` with only the functions the request needs (every name is listed in this input schema / description); omit `names` only when you cannot tell which functions apply. Always call this before your first `execute` and never guess signatures. Request every function the task may need in ONE call instead of calling this repeatedly.

  Paramètres, retour & exemple (1)

  Paramètres

  • names · array · optionnel
    Names of the sandbox functions to discover: listApis, getEndpoints, getEndpointInfo, getSecuritySchemes, getFullApiDescription, search, listPages, getPage, grepPages. Omit to discover all of them.

  Exemple d'appel

  {"name": "discover", "arguments": {"names": []}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• execute≈ 569 tokens

  Run JavaScript in a sandbox against the documentation at https://redocly.com. The script calls the sandbox functions on the global `site` object. The only extra global is `site` - there is no `fetch`, `console`, `setTimeout`, `require`, or Node.js API; all I/O goes through `site`. Workflow - minimize round-trips; one `discover` call plus one `execute` call covers most requests: 1. Analyze the request and decide which sandbox functions it needs. 2. Call `discover` with those names to get their exact TypeScript signatures - inputs, result shapes, and a worked example. NEVER call `execute` with guessed function names, parameter names, enum values, or result field names: read fields off the declared return types, not from assumptions. 3. Batch everything into a SINGLE script: chain function calls, pass one call's output into the next, process results in plain JavaScript, and `return` only what the request needs. Functions for `execute` scripts (signatures come from `discover`): - listApis — List the available APIs. - getEndpoints — Get all endpoints for an API. - getEndpointInfo — Get the details of an endpoint. - getSecuritySchemes — Get the security schemes for an API. - getFullApiDescription — Get the complete OpenAPI description. - search — Search the documentation. - listPages — List the docs navigation, one level per call. - getPage — Read a docs page as Markdown, in line windows. - grepPages — Find the docs lines that contain a text.

  Paramètres, retour & exemple (2)

  Paramètres

  • code · string · requis
    JavaScript to run in the sandbox. Return a value to receive it as the result.
  • description · string · requis
    A short, human-readable summary of what this code does.

  Exemple d'appel

  {"name": "execute", "arguments": {"code": "texte", "description": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"error": "texte", "result": "texte"}}

• submit-feedback≈ 330 tokens

  Report a documentation page that is wrong or incomplete. Use it when the user reports a problem with a page on this site, or agrees to report a problem that you found. Do not use it for product bugs or support questions.

  Paramètres, retour & exemple (4)

  Paramètres

  • path · string · requis
    Path or URL of the documentation page the feedback is about (e.g. /guides/auth)
  • details · string · optionnel
    Expected versus actual behavior, missing steps, or the snippet that failed
  • summary · string · requis
    One sentence that names what is wrong with the page
  • targetFeature · string · optionnel
    The API or feature the page documents

  Exemple d'appel

  {"name": "submit-feedback", "arguments": {"path": "texte", "summary": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"page": "texte", "status": "texte", "message": "texte"}}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://redocly.com/mcp