Skip to content

Redocly

by redocly.com · remote · no sign-in to list tools · v1.0.0 · published by com.redocly

Search and read the Redocly product docs, guides and blog on redocly.com, and report a wrong page.

Changes · 2
CompareRegistry entry

3 tools: 2 change things and 1 only read.

Scanned Oct 21, 2026

1 check matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http redocly https://redocly.com/mcp

Findings

Matches of fixed checks, with the text they matched.

1 warn
  • Warnexecute

    The server marks "execute" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":false}; The name "execute" says "execute": a word for a change.

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

3 tools

Changes things 2Claude Code: ask
  • executeRun JavaScript in a sandbox against the documentation at https://redocly.com.1 finding

    Why it is in this group

    • The name "execute" says "execute": a word for a change.
    • The input takes a statement or command to run (input.code), which can change anything it can reach.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "execute" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":false}; The name "execute" says "execute": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Run JavaScript in a sandbox against the documentation at https://redocly.com. The script calls the sandbox functions on the global `site` object. The only extra global is `site` - there is no `fetch`, `console`, `setTimeout`, `require`, or Node.js API; all I/O goes through `site`. Workflow - minimize round-trips; one `discover` call plus one `execute` call covers most requests: 1. Analyze the request and decide which sandbox functions it needs. 2. Call `discover` with those names to get their exact TypeScript signatures - inputs, result shapes, and a worked example. NEVER call `execute` with guessed function names, parameter names, enum values, or result field names: read fields off the declared return types, not from assumptions. 3. Batch everything into a SINGLE script: chain function calls, pass one call's output into the next, process results in plain JavaScript, and `return` only what the request needs. Functions for `execute` scripts (signatures come from `discover`): - listApis — List the available APIs. - getEndpoints — Get all endpoints for an API. - getEndpointInfo — Get the details of an endpoint. - getSecuritySchemes — Get the security schemes for an API. - getFullApiDescription — Get the complete OpenAPI description. - search — Search the documentation. - listPages — List the docs navigation, one level per call. - getPage — Read a docs page as Markdown, in line windows. - grepPages — Find the docs lines that contain a text.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • title: Query the docs with code
  • submit-feedbackReport a documentation page that is wrong or incomplete.No findings

    Why it is in this group

    • The name "submit-feedback" says "submit": a word for a change.
    Description, as the server wrote it
    Report a documentation page that is wrong or incomplete. Use it when the user reports a problem with a page on this site, or agrees to report a problem that you found. Do not use it for product bugs or support questions.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
    • title: Submit feedback
Only reads 1Claude Code: allow
  • discoverGet the exact TypeScript signatures of the sandbox functions that `execute` scripts can call.No findings

    Why it is in this group

    • The description's first verb is "get": a word for reading.
    Description, as the server wrote it
    Get the exact TypeScript signatures of the sandbox functions that `execute` scripts can call. Analyze the user request first, then pass `names` with only the functions the request needs (every name is listed in this input schema / description); omit `names` only when you cannot tell which functions apply. Always call this before your first `execute` and never guess signatures. Request every function the task may need in ONE call instead of calling this repeatedly.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • title: Get docs function signatures

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http redocly https://redocly.com/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__redocly__discover"
    ],
    "ask": [
      "mcp__redocly__execute",
      "mcp__redocly__submit-feedback"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as redocly. Review it before you use it.