Atlas / MCP servers / api-200 / Api200

Api200BLOCK

Name: Api200
Author: api-200

mcp/api-200/api200

MCP server by api-200 · alternative · api · api gateway · Audited 2026-10-06

API 200 is an open source API gateway to simplify 3rd-party integrations. Import endpoints, set up caching, retries, and mocks. Access all services via one URL. Monitor logs, track errors, and get alerts on API incidents.

Verdict

BLOCK

Grade

Trust score

69 /100

Exposed tools

1 1r · 0w · 0d

Transport

stdio

License

NOASSERTION

Stars

257

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

The Open Source API Integration Platform.

Learn more »

Website · Issues · Roadmap

About API 200

API 200 is all-in-one gateway for managing third-party APIs efficiently. Integrate third-party APIs or setup MCP server in minutes with auto-generated code, docs, auth, caching and error handling – so you can focus on what really matters.

Key Features

✅ Fast API Setup:

Authentication management
Response caching
Automatic retries
Mock responses
Response transformation
Fallback responses
Custom headers

✅ Schema Watching: Get notified when one of your APIs changes response schema

✅ Incident Detection: Dedicated tab for incidents automatically detected by the system

✅ In-browser Swagger Integration

✅ Import Endpoints from OpenAPI and Postman

✅ Endpoint Monitoring: Convenient charts with your endpoint's statistics

✅ Comprehensive Logging

✅ MCP Support (read more)

Features in Progress:

More authentication methods

[//]: # (## Interactive Demo)

[//]: # ()

[//]: # (Try out our interactive demo to see API 200 in action: [Try Demo](PLACEHOLDERDEMOLINK))

Quickstart

Get started immediately with our managed version of API 200. Users can go to our cloud platform and start integrating API endpoints instantly without any setup or infrastructure management. Visit API200.co to begin.

MCP

To configure the API200 MCP server with Claude Desk

Read from source at commit d023d6cc3288OBSERVED · 2026-10-06

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add api200-mcp --env API200_KEY=${API200_KEY} --env BREVO_API_KEY=${BREVO_API_KEY} --env PADDLE_API_KEY=${PADDLE_API_KEY} --env USER_KEY=${USER_KEY} -- npx -y [email protected]

claude-desktop

{
  "mcpServers": {
    "api200-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "API200_KEY": "${API200_KEY}",
        "BREVO_API_KEY": "${BREVO_API_KEY}",
        "PADDLE_API_KEY": "${PADDLE_API_KEY}",
        "USER_KEY": "${USER_KEY}"
      }
    }
  }
}

Exposed tools (1)

1 read · 0 write · 0 destructive.

Tool	Risk	Description
`demo-project`	read	Demo project for JSON Placeholder API with enabled MCP Server

Trust audit

BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	PASS
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (6 observation(s))
Network: declared (5 observation(s))
Shell: declared (1 observation(s))
Dependencies: not all pinned
Secrets in source: found

Findings (13)

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

packages/backend/src/modules/executeUserFunction.ts:60

const userTransform = new Function(

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHHard-coded secrets · secret.db_uri · CWE-798, CWE-321

packages/backend/package.json:12

"supabase:m": "pnpm dlx supabase migration up --db-url postgres://postgres.$POOLER_TENANT_ID:$POSTGRES_PASSWORD@supabase-pooler:5432/postgres",

LOWInventory / provenance · inv.hidden_file · CWE-1104

packages/backend/.prettierignore

.prettierignore

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

packages/backend/src/modules/base/apiKeyValidation.ts:2

import { cache } from '../../utils/cache';

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

packages/backend/src/modules/base/apiKeyValidation.ts:3

import { DAY } from '../../utils/constants';

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

packages/backend/src/modules/base/apiKeyValidation.ts:5

import { supabase } from '../../utils/supabase';

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

packages/backend/src/modules/base/checkUsage.ts:2

import { supabase } from '../../utils/supabase';

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

packages/backend/src/modules/base/mapUrlParams.ts:1

import { Tables } from '../../utils/database.types';

LOWSupply chain · supply.unpinned · CWE-829, CWE-1357

package.json

@modelcontextprotocol/sdk, jsonwebtoken

Why it matters. 2 dependency range(s) float