# Autopia

> Verified, reproduced behavior of public HTTP APIs: spec gaps, errors, pagination, auth.

- name: io.github.MaydayTrey/autopia
- version: 0.3.1
- connection class: R0 (autonomous)
- trust: 97/100
- quality: 75/100 (good)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/io.github.MaydayTrey%2Fautopia
- tools: https://api.protogrid.dev/v1/servers/io.github.MaydayTrey%2Fautopia/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "autopia": {
      "type": "http",
      "url": "https://autopia-mcp.onrender.com/mcp",
      "headers": {
        "Authorization": "Bearer ${AUTOPIA_TOKEN}"
      }
    }
  }
}
```

Placeholders to fill: `${AUTOPIA_TOKEN}`.

## Trust

- hygiene: 100
- liveness: 100
- freshness: 100
- provenance: 90
- drivers: +repository +namespace-matches-repo +website +reachable +uptime-100% +updated-8d-ago
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 75/100 (good)

### protocol: 75 (weight 25)

- warn `protocol.modern`: newest supported version is 2025-11-25; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
- n/a `protocol.stateless`: only applies to 2026-07-28 servers
- pass `protocol.transport`: streamable HTTP
- n/a `protocol.list_ttl`: only applies to 2026-07-28 servers

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 100 (weight 30)

- pass `tools.descriptions`: every tool has a description
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- pass `tools.annotations`: 9 of 9 tools declare readOnlyHint or destructiveHint
- pass `tools.directory_hints`: every tool declares readOnlyHint, destructiveHint, idempotentHint and openWorldHint
- pass `tools.token_cost`: about 1,675 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: 25 (weight 15)

- warn `stability.changes`: 9 tool changes in 30 days
- fail `stability.rug_pull`: 3 tools kept their name but changed most of their description in 30 days; review before trusting them

### dependencies: n/a (weight 15)

- n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: no npm or PyPI package

- tools: 9, about 1,675 tokens to load them all
- tool set hash: 22fba4ab2cbfd25b3aec6da7e2999844
- tools last changed: 2026-10-13T03:09:39.432Z
- badge: [![protogrid quality](https://protogrid.dev/badge/io.github.MaydayTrey/autopia.svg)](https://protogrid.dev/servers/io.github.MaydayTrey/autopia)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

- 2026-10-13 `get_request_status` changed (description, annotations)
  - before: Status of a target request: pending | running | done | failed, with the run id and summary once processed.
  - after: Status of a target request (pending, running, done or failed), with the run id and summary once processed.
- 2026-10-13 `request_target` changed (description, annotations)
  - before: The API you are about to call is NOT covered (not in list_tools)? Ask the compendium to test it. Pass a target object: { name, spec_url (OpenAPI 3 document), category?, include_paths?, baseline? (valid values for required params per path), optional_values?, server? }. Scope: public read-only APIs with no credentials (no headers accepted). The request is validated now (spec fetched and parsed, battery planned) and processed rules-only on the worker's next pass; use get_request_status with the returned id. Requires a per-user key. Quota: 3 requests per key per day.
  - after: Queues a public, read-only, credential-free API for probing, from a target object { name, spec_url (OpenAPI 3 document), category?, include_paths?, baseline? (valid values for required params per path), optional_values?, server? }. The spec is fetched and parsed and the battery planned immediately; probing runs rules-only on the worker's next pass. Requires a per-user key; quota 3 requests per key per day. Returns a request id for get_request_status.
- 2026-10-13 `get_version_diff` changed (description, annotations)
  - before: What changed in verified BEHAVIOR between two spec versions of an API (changed / added / removed claims), as opposed to what changed in the spec text. Version ids come from list_versions.
  - after: What changed in verified behavior between two spec versions of an API (changed, added and removed claims), as opposed to what changed in the spec text.
- 2026-10-13 `get_tool_docs` changed (description, inputSchema, annotations) **meaning changed**
  - before: READ THIS BEFORE YOUR FIRST CALL to an API the compendium covers. Pass the host or URL you are about to call (api.github.com, https://registry.npmjs.org/-/v1/search) or the tool name. Returns a Markdown behavior sheet built only from verified claims: where the API contradicts its spec first, then sibling differences, undocumented rules, and per-endpoint behavior (error shapes, pagination, validation, auth). Each line cites the trial ids that back it. One read; no need to repeat it in the same session. brief=true returns only spec divergences, undocumented rules, and auth / pagination / error behavior (about a third of the size). Pass the request path (or a full URL as tool) to get ONLY the endpoint you are about to call plus a one-line index of the others; descend to another by passing its path.
  - after: The verified behavior sheet for an API: Markdown built only from verified claims, with spec contradictions first, then sibling differences, undocumented rules, and per-endpoint behavior (error shapes, pagination, validation, auth), every line citing trial ids. Accepts a tool name, a host, or the full URL about to be called; a URL or path scopes the sheet to that endpoint plus a one-line index of the others. Brief by default (what would change the request); full=true adds per-parameter validation, response shapes and all evidence ids.
- 2026-10-13 `search_claims` changed (description, annotations)
  - before: Call this when an API call FAILED or behaved unexpectedly: an unexpected 4xx/5xx, a parameter that seems ignored, an odd page, wrong filter results. Full-text search over verified claims with the host and the symptom, e.g. "github per_page 500", "npm search size 0", "is latitude required on /v1/forecast". Optionally restrict to one API (name, host or URL). Compact evidence unless verbose=true.
  - after: Full-text search over verified claims by host and symptom, e.g. "github per_page 500", "npm search size 0", "is latitude required on /v1/forecast": the lookup for an unexpected 4xx/5xx, a parameter that seems ignored, an odd page, or wrong filter results. Optionally restricted to one API (name, host or URL). Compact evidence unless verbose=true.
- 2026-10-13 `get_divergences` changed (description, annotations)
  - before: Where the live API CONTRADICTS its own OpenAPI spec: documented limits not enforced, types not validated, required params not required, enums that accept other values. Read before trusting a spec-generated client or SDK for this API. Compact evidence; verbose=true adds response previews.
  - after: Where the live API contradicts its own OpenAPI spec: documented limits not enforced, types not validated, required parameters not required, enums accepting other values. Compact evidence; verbose=true adds response previews.
- 2026-10-13 `get_tool_knowledge` changed (description, annotations)
  - before: Every VERIFIED claim about an API as structured records (latest version by default), paginated, spec divergences flagged, each with compact evidence (trial id, probe, status, request line). Use when you need to filter by kind or process claims programmatically; for the one-read summary before calling the API use get_tool_docs. verbose=true adds response previews.
  - after: Every verified claim about an API as structured records (latest version by default): paginated, filterable by kind, spec divergences flagged, each with compact evidence (trial id, probe, status, request line). verbose=true adds response previews.
- 2026-10-13 `list_versions` changed (description, annotations) **meaning changed**
  - before: Spec versions of one API, newest first, each fingerprinted by its spec hash. Use with get_version_diff when a spec changed and you want to know what changed in BEHAVIOR.
  - after: The spec versions recorded for one API, newest first, each fingerprinted by its spec hash. The ids identify versions for get_version_diff.
- 2026-10-13 `list_tools` changed (description, annotations) **meaning changed**
  - before: Which APIs the compendium covers, each with the HOSTS its trials hit (match the URL you are about to call), trust tier, version count and verified-claim / divergence counts. Call once per session; then get_tool_docs for the host you are about to call.
  - after: The APIs the compendium covers: each with the hosts its trials hit, trust tier, version count, and counts of verified claims and spec divergences.

Full history: https://api.protogrid.dev/v1/servers/io.github.MaydayTrey%2Fautopia/changes

## Remotes

- https://autopia-mcp.onrender.com/mcp (streamable-http, auth none, reachable true, uptime30d 1)

## Packages

_none_

## Tools (9)

- `get_divergences`: Where the live API contradicts its own OpenAPI spec: documented limits not enforced, types not validated, required parameters not required, enums accepting other values. Compact evidence; verbose=true adds response previews.
- `get_request_status`: Status of a target request (pending, running, done or failed), with the run id and summary once processed.
- `get_tool_docs`: The verified behavior sheet for an API: Markdown built only from verified claims, with spec contradictions first, then sibling differences, undocumented rules, and per-endpoint behavior (error shapes, pagination, validation, auth), every line citing trial ids. Accepts a tool name, a host, or the full URL about to be called; a URL or path scopes the sheet to that endpoint plus a one-line index of the others. Brief by default (what would change the request); full=true adds per-parameter validation, response shapes and all evidence ids.
- `get_tool_knowledge`: Every verified claim about an API as structured records (latest version by default): paginated, filterable by kind, spec divergences flagged, each with compact evidence (trial id, probe, status, request line). verbose=true adds response previews.
- `get_version_diff`: What changed in verified behavior between two spec versions of an API (changed, added and removed claims), as opposed to what changed in the spec text.
- `list_tools`: The APIs the compendium covers: each with the hosts its trials hit, trust tier, version count, and counts of verified claims and spec divergences.
- `list_versions`: The spec versions recorded for one API, newest first, each fingerprinted by its spec hash. The ids identify versions for get_version_diff.
- `request_target`: Queues a public, read-only, credential-free API for probing, from a target object { name, spec_url (OpenAPI 3 document), category?, include_paths?, baseline? (valid values for required params per path), optional_values?, server? }. The spec is fetched and parsed and the battery planned immediately; probing runs rules-only on the worker's next pass. Requires a per-user key; quota 3 requests per key per day. Returns a request id for get_request_status.
- `search_claims`: Full-text search over verified claims by host and symptom, e.g. "github per_page 500", "npm search size 0", "is latitude required on /v1/forecast": the lookup for an unexpected 4xx/5xx, a parameter that seems ignored, an odd page, or wrong filter results. Optionally restricted to one API (name, host or URL). Compact evidence unless verbose=true.