Finds where your API drifted from its spec.

An open-source CLI and MCP server that runs your OpenAPI spec against a live implementation and tells you which side to fix.

npx apidrifter plan openapi.yaml
Turn the spec into a request plan with the slots an agent or you fill in.
npx apidrifter run openapi.yaml --base-url http://localhost:3000
Execute the plan against a running server and verify every response.
npx apidrifter serve
The same loop as an MCP server, so any agent can drive it.

How it works

01

Plan

The engine reads the spec and proposes one request per operation, with the parameters, body and auth it needs. Values come from the spec’s own examples; an agent or a small file supplies the rest.

02

Run

Requests go to your dev, staging or production server. Responses are matched to the operation and validated: status, media type, headers and body, with the schema’s direction taken into account.

03

Report

Every finding carries two fixes: what to change in the implementation if the spec is the truth, and what to change in the spec if the implementation is. Humans read it; agents act on it.

Also a spec differ

The same engine compares two versions of a spec and classifies every change as breaking, warning or info, knowing that a field becoming required is breaking in a request and harmless in a response.

npx apidrifter breaking old.yaml new.yaml   # exit 1 on breaking changes, for CI
npx apidrifter mcp snapshot https://mcp.example.com/mcp --out before.json
npx apidrifter mcp diff before.json https://mcp.example.com/mcp

MCP servers are covered too: tools, resources and prompts are snapshotted and diffed, and a changed tool description is tracked as a change, because descriptions are what agents act on.

9 of 13 public APIs do not match their own spec.

We sent read-only requests to 13 public APIs that publish an OpenAPI document and found 171 hard violations on successful responses: wrong types, missing required fields, nulls the schema forbids. Every request is reproducible.

Read the survey

Install

npm install -g apidrifter    # or run it with npx, as above

Node 22.12 or newer. Apache-2.0. The CLI sends requests only where you point it; URLs other than localhost must be HTTPS. Secrets passed as headers are never written to output.

CLI reference · Rules reference· Design ·GitHub