API Commons Tools
Browser-first, backend-free tools for working with the APIs you produce and consume. Everything runs locally in your browser — your tokens and data never leave it. Part of the APIs.io network.
Not sure where to start?
Tell us what you're trying to do. We'll map your priorities to the right API Commons tools and put them in the order to pick them up.
Agent Rule Export
Turn a governance ruleset into agent-native guidance so agents follow the rules while authoring, not just after linting. Exports an AGENTS.md governance block, a system-prompt instruction set, a per-rule remediation prompt pack, and a compact rule digest — from the 769-rule catalog or your own Spectral ruleset. No backend.
API Certification
Issue and verify tamper-evident API governance certificates — a consumer-facing trust stamp attesting that an API description passed a named ruleset at a profile threshold. A SHA-256 fingerprint of the API + ruleset lets anyone re-verify it: if the API drifts or the certificate is forged, verification fails. Reference it from your apis.json. No backend.
API Discovery
A browser-first registry for API artifacts. Search APIs.io and code across GitHub / GitLab / Bitbucket, keep a provenance pointer back to where you found each one, save locally, and commit or open a PR to git with your own token. Edit with Monaco, then roll everything into a single APIs.json 0.21 index.
API Documentation
Standalone documentation for any APIs.json — rich HTML docs for every API, property, and inline artifact, with OpenAPI rendered as a full reference and Arazzo workflows as step-by-step timelines. Zip the viewer up next to an apis.json, bundle both into a single portable HTML file, or document any APIs.json by URL. Supports every version, 0.11 through 0.21.
API Experience
A DX/AX visual layer for any APIs.json. See each REST operation flow to its MCP tool and Agent Skill — the API → MCP → Agent-Skill chain — with a free/paid coverage scorecard that shows which operations are wired end-to-end and which have a gap. Reads the tiers and mappings from the OpenAPI's x-tier / x-apis-io extensions; defaults to apis.io and API Evangelist. No backend.
API Governance Graph
Binds the governance building blocks — rules, policies, provenance, guidance, experiences, and lifecycle — into one navigable graph. Walk the Guidance Stack from any node to everything bound to it, then flip to the Gaps view to see exactly where it breaks: rules no policy enforces, policies with no stated why, guidance nobody links. Built from the 769-rule catalog + the apievangelist.com building blocks. No backend.
API Governance MCP
The AI surface of the API Validator — a Model Context Protocol server that lets any AI client lint your OpenAPI, AsyncAPI, Arazzo, APIs.json, JSON Schema, MCP, and more against a best-of-breed governance ruleset, conversationally. Powered by Spectral, running the same engine and 733-rule ruleset as the Validator. Drop it into Claude, Cursor, or any MCP client and ask it what to fix.
API Reusability
Assess how reusable the APIs across your organization really are. Discover evidence of APIs from APIs.io, code search, HAR uploads, and gateways; index them as OpenAPI in an APIs.json inventory; then score reusability and duplication — rolled up by org, team, or business domain.
API Validator
A simple, browser-first governance validator for OpenAPI, AsyncAPI, Arazzo, and JSON Schema, powered by Spectral. Search GitHub / GitLab / Bitbucket for real artifacts, lint against a best-of-breed ruleset, toggle any rule or edit it in Monaco, then commit or open a PR back to Git with your own token. No backend — everything runs locally.
Code-First Governance
For teams that generate OpenAPI from code annotations. Detects the generator (springdoc, FastAPI, NestJS, go-swagger, drf-spectacular, tsoa…), separates code-gen-caused findings from authoring ones, and tells you the exact annotation to fix in code — bridging the gap where Spectral doesn't fit a code-first workflow.
Context Gate
Consumer-centric governance for the agentic era: choose exactly which operations and fields your APIs expose to agents, and emit a governed Tyk OpenAPI + MCP surface plus a Spectral ruleset for it — with PII, secret, and compliance checks on what reaches the agent. Search APIs.io / GitHub or upload. No backend.
Governance Baseline
Adopt a strict ruleset on an estate that already exists. Snapshot today's violations into a baseline, then fail only NEW ones while baselined issues are suppressed, enforce a warning budget, and burn the baseline down to zero — no more wall of red that gets the check switched off.
Governance Coverage
Measures how much of your API description your governance actually looks at — like test coverage, one altitude up. Resolves every rule's JSONPath against your OpenAPI to report coverage by section, the rules that match nothing (dead weight for this API), and each rule's reach. Use the 769-rule catalog or paste your own Spectral ruleset. No backend.
Governance Pipeline
A reference API governance pipeline you can fork — PR-gated, path-filtered, SHA-pinned, with a dedicated OWASP security job and a human-readable report. The blueprint from the State of Spectral research, assembled from parts real teams already ship. A composite GitHub Action: uses: api-commons/governance-pipeline@v1.
Governance Pipeline Auditor
Lint your linting. Scan a repo's Spectral CI setup and score it against an 8-point governance maturity rubric — does it gate the PR, pin its tooling, own its ruleset, run a security layer, emit a report — then get a prioritized punch-list of fixes. CLI, GitHub Action, and browser. Built from the State of Spectral in API Pipelines research.
Governance Scorecard
Governance health over time, not just today. Ingest a series of lint runs, score each spec 0–100, and render trend lines per spec and across the estate — with the specs whose problem lists are growing ranked at the top so you act before one goes the wrong direction.
Governance Waivers
Make governance exceptions sanctioned, owned, and expiring instead of teams routing around the rules. Author a machine-readable waivers file and reconcile it against Spectral lint output: waived violations are suppressed, while expired, stale, and expiring waivers surface — and you get the effective failing set to gate your build on. No backend.
MCP Install
The universal install button for MCP servers — one button, every client. One-click deep links for Cursor, VS Code, LM Studio, and Goose; ready-to-run CLI commands and per-OS config snippets for Claude Code, Claude Desktop, Windsurf, Zed, and twenty more; connector walkthroughs for Claude and ChatGPT. Driven by an open, machine-readable registry of client install methods, and native to MCP Registry server.json.
Model Library
A shared, versioned component/model library. Author reusable schemas, see which specs consume each model, and when a model version bumps, classify the change as breaking or non-breaking for every consumer. A drift detector finds the three variants of your User model across teams.
Rule Federation
A federated rule registry — a small central baseline plus the domains that adopt it. See the federation as a matrix: who inherits a rule, who overrides its severity and why, who waived it, which rules are contested, unstewarded, or orphaned, and which local rules to promote back to the center. Because a single central registry breaks down — governance has to be centralized and federated.
Ruleset Commons
A registry of adoptable, provenanced governance rulesets — adopt a real owned ruleset by reference instead of running the linter's defaults. National (Italy, Netherlands), industry, security, and company rulesets, each with real provenance and a copy-paste extends snippet. The supply side of owned governance.
Spec Review
A $ref-resolving, human-readable diff of two API descriptions for the design phase. Resolves references so reviewers see the real shape, flags each change as added / removed / breaking in plain English, and hands you a Markdown summary to paste into the PR — because reviewing raw YAML is hostile to non-engineers.
Spectral OWASP Ruleset
A grounded Spectral ruleset for the OWASP API Security Top 10 — 22 rules across all ten categories, each mapped to its OWASP item with a severity and a docs link. Add a real security governance layer in one line: extends: ['@api-common/spectral-owasp-ruleset']. Only 14% of real pipelines run any security rules — this is the easy fix.
Spectral Reporter
Turn a Spectral lint run into a beautiful, self-contained HTML governance report — severity summary, grouped by rule and file, top offenders, searchable, and framed toward progress instead of just deficits. The newman-reporter-htmlextra for API governance. Now with SARIF output for GitHub code scanning and trend reports over time. CLI + browser.
Spectral Ruleset Studio
Turn a prose style guide into an owned, grounded, well-named Spectral ruleset. Distill each statement into a rule with a real function, tuned severity, and the who/what/when/where/why grounding that turns a bare verdict into guidance — then download a ready .spectral.yaml. Twenty grounded starter templates included.
Toolsmith
Forge the agent layer of your API. Load any OpenAPI and design a rich MCP tool for every operation — input schema, behavior annotations, resources, prompts, and sampling — plus one or more Agent Skills per tool, all stored as x-mcp / x-agent-skills extensions in the contract itself. Spec checks lint the design; exports include the enriched OpenAPI, MCP server design, registry server.json, and a skills bundle with a discovery index.