Apifox Filter MCP Server (xiaou66/apifox-filter-mcp-server) is an MCP server listed on the M8ven Trust Index. It scores 56 out of 100, grade D. It declares 9 tools. No publisher has claimed this listing.

Back to MCP Trust IndexM8ven
D
Caution
56/100

Apifox Filter MCP Server

Precisely filter and fetch API documentation from Apifox or any OpenAPI URL, reducing context bloat by fetching only needed endpoints.

→ xiaou66/apifox-filter-mcp-server· listed on glama

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

xiaou66

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

⚡ Connect GitHub for Live Monitored

Install from

Glamanot scored here

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
⚠️
Known vulnerabilities in dependencies: 5 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
✅
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
🔐
You'll be asked for 1 credential: APIFOX_ACCESS_TOKEN
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// tools this server exposes9 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

smart_search_api

根据自然语言描述智能搜索接口，AI 的首选搜索工具。 核心能力： - 自动提取关键词并映射到接口路径 - 支持中英文混合查询 - 按相关度排序返回结果 使用场景： - 用户描述功能需求："查找用户登录接口" → 搜索 login/auth - 用户询问模块接口："达人管理有哪些接口" → 搜索 influencer/daren - 用户描述业务场景："获取订单列表" → 搜索 order/list 优先使用此工具进行语义搜索，再用 get_api_detail 获取详情

search_api

根据 URL 模式搜索接口，这是查找接口的首选工具。 使用场景： - 当用户提到任何 API 路径或 URL 时，自动调用此工具查询 - 当用户询问某个功能的接口时，根据关键词搜索 - 当需要了解某个模块有哪些接口时 支持的匹配模式： - 精确匹配：/api/users - 通配符：/api/users/* 匹配所有子路径 - 模糊搜索：users、influencer 等关键词 - 路径片段：daren/influencer 匹配包含该片段的所有接口

get_api_detail

获取单个接口的完整文档。 使用指引： - 已经知道接口路径时，直接传 path 获取详情 - 先用 search_api 查到候选，再用本工具精确查看参数/请求体/响应/示例 - method 可选，未提供时返回该 path 下所有方法（如同时存在 GET/POST）

list_api_by_tag

按标签筛选接口列表

list_api_by_folder

按 Apifox 文件夹路径筛选接口列表，支持精确和模糊匹配

list_api_folders

列出所有 Apifox 接口文件夹目录结构

batch_get_apis

批量获取多个接口的详细信息

list_all_endpoints

列出所有接口的路径和方法（仅返回摘要信息）

refresh_cache

刷新接口缓存，从 Apifox 重新获取最新数据

// known CVEs in dependencies5 high8 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.25.2GHSA-345p-7cg4-v4c7

@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

highundici@6.23.0GHSA-f269-vfmq-vjvj

Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client

highundici@6.23.0GHSA-v9p9-hfj2-hcw8

Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation

highundici@6.23.0GHSA-vrm6-8vpv-qv8q

Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompression

highundici@6.23.0GHSA-vxpw-j846-p89q

undici WebSocket client vulnerable to denial of service via fragment count bypass

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
🔐 secretAPIFOX_ACCESS_TOKENmoduleIds, branchId
configAPIFOX_API_BASEhttps://api.apifox.com
configAPIFOX_BRANCH_IDbranch-id=<id> 或 : 指定分支 ID，默认导出主分支
configAPIFOX_MODULE_IDS模块 ID 列表（逗号分隔） -
configAPIFOX_PROJECT_ID项目 ID（也可通过命令行参数指定） -
configCACHE_DIR必须配置，否则会报错在 Antigravity 环境中获取不到项目目录
configLOG_LEVEL
configMISS_REFRESH_COOLDOWN自动刷新冷却（秒） 60
configOPENAPI_URLOpenAPI 文档 URL（URL 模式） -
configPROJECT_DIR当前工作目录
configREFRESH_INTERVAL定时刷新间隔（分钟），0 禁用 30
configREFRESH_ON_MISStrue
// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

9/9 tools missing one or more hints — smart_search_api (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); search_api (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_api_detail (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +6 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

License file

No license file

Add a LICENSE file (MIT, Apache-2.0, etc.).

Tests exist

No test files found

Add tests that exercise each declared tool.

Production dependencies are patched

0 critical, 5 high severity in production deps — @modelcontextprotocol/sdk@1.25.2 (high), undici@6.23.0 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 5 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/xiaou66/apifox-filter-mcp-server?variant=verified)](https://m8ven.ai/mcp/xiaou66/apifox-filter-mcp-server)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: b8db03bf7a36dc2205ca54ed34746afeb2179c68
code hash: 983b4a3ed9124e785add103cb6c10b6f406539a60b8332c60cf7f7b7e6562a2c
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client