yapi-qx-mcp

Auditable YApi MCP Server (stdio only). Tool names compatible with yapi-auto-mcp for easy replacement.

Security

• Outbound HTTP is limited to the configured YAPI_BASE_URL origin
• Path allowlist: /api/project/get, /api/interface/get|list|list_cat|getCatMenu|add|up
• No Express / SSE port; no disk cache; no telemetry / eval / child_process
• Token is masked in logs; pin versions in production: npx -y [email protected]

Source is small and reviewable; audit before relying on it in sensitive environments.

MCP config (Cursor / Claude)

{
  "mcpServers": {
    "yapi": {
      "command": "npx",
      "args": ["-y", "yapi-qx-mcp", "--stdio"],
      "env": {
        "YAPI_BASE_URL": "https://yapi.example.com",
        "YAPI_TOKEN": "projectId:your_token",
        "YAPI_CACHE_TTL": "10",
        "YAPI_LOG_LEVEL": "info"
      }
    }
  }
}

YAPI_TOKEN format: projectId:token; multiple projects: id1:tok1,id2:tok2.

Tools

| Tool | Purpose | |------|---------| | yapi_list_projects | List projects for configured tokens | | yapi_get_categories | Categories + APIs under a project | | yapi_search_apis | Search APIs | | yapi_get_api_desc | API detail | | yapi_save_api | Create/update (prefer single-API sync) |

Connectivity check

After restarting MCP, ask:

YAPI connectivity test

Expect a successful yapi_list_projects listing.

Develop

npm install
npm run build
npm start

Publish

npm run build
npm publish --access public

Do not commit real tokens.