submit: shahadattest-mcp-doctor

submissions/mcp-hackathon/shahadattest-mcp-doctor/RIGHTS.md

@@ -0,0 +1,16 @@
+# Submission rights declaration
+
+Project: `MCP Doctor`
+Submission slug: `shahadattest-mcp-doctor`
+Submitter: `shahadattest`
+Date: `2026-09-04`
+
+The submitter confirms that they own, or have sufficient authorization for, the source code, dependencies, service, data, branding, and other materials submitted in this pull request.
+
+Subject to the official program terms, the submitter authorizes X-Agent to retain, reproduce, audit, test, archive, and publish the submitted program artifact for judging, fraud prevention, dispute handling, ecosystem submission, and post-award accountability. Closing the pull request, deleting a fork, or deleting an external repository does not revoke the official archive rights attached to an accepted and rewarded entry.
+
+Third-party components and their licenses: FastAPI (MIT), uvicorn (BSD), Pydantic v2 (MIT), SQLAlchemy (MIT), httpx (BSD), PyYAML (MIT), jsonschema (MIT), pytest (MIT), nginx (BSD) — see `source/` manifests.
+
+Exceptions or restrictions: `none`
+
+This template is an operational declaration, not a substitute for event terms reviewed by qualified counsel.

submissions/mcp-hackathon/shahadattest-mcp-doctor/SUBMISSION.md

@@ -0,0 +1,47 @@
+# MCP Doctor
+
+## Capability
+
+- **One-line description:** Turn any OpenAPI-described API into a tested, normalized, agent-ready tool with a before/after readiness score.
+- **Who it helps:** Developers and AI agents that need strict schemas, predictable outputs, and standardized failures from third-party APIs.
+- **Capability boundary:** Does API discovery, live safe-method testing, deterministic quality scoring, declarative response normalization, proxying, and tool-JSON generation. Does NOT modify upstream APIs, does NOT do security auditing, penetration testing, or risk scoring.
+
+## Live API
+
+- **API base URL:** `https://belts-raymond-advertisements-radical.trycloudflare.com/api` (local verified: `http://localhost:8000/api`)
+- **Health-check URL:** `https://belts-raymond-advertisements-radical.trycloudflare.com/health`
+- **Authentication:** none
+- **Rate limits / known limits:** No auth limits; upstream calls timeout 10s, max 2 retries, 1MB response cap. Auto-test covers GET/HEAD/OPTIONS only.
+- **API contract:** `source/examples/broken-demo-api/openapi-demo.json` + live OpenAPI at `/openapi.json`; endpoint docs in `source/docs/api.md`.
+
+## Source and reproducibility
+
+- **Source repository:** `https://github.com/ShahadatTest/mcp-doctor`
+- **Review commit:** `3ce175fb14a0e176a9b29a2c213d78d4fab91bad`
+- **Source submitted in this PR:** `source/`
+- **Run tests:** `cd source/backend && pip install -r requirements.txt && python -m pytest tests/ -q` (8 passed)
+- **Run locally:** `cd source && docker-compose up --build` (frontend :3000, backend :8000, demo :8001)
+- **Deploy:** build `source/backend/Dockerfile`, set `GIT_COMMIT=<review-commit>` and `PROJECT_SLUG=shahadattest-mcp-doctor`
+- **Version binding:** `/health` returns `{"status":"ok","commit":"<review-commit>"}` and `/.well-known/xagent-verification.json` returns `{"schemaVersion":1,"slug":"shahadattest-mcp-doctor","commit":"<review-commit>"}`
+
+## Verification
+
+The reproducible call instructions and redacted example responses are in `verification/README.md`.
+
+- **Health-check result:** `{"status":"ok","service":"mcp-doctor","version":"0.1.0","commit":"3ce175fb14a0e176a9b29a2c213d78d4fab91bad"}`
+- **Capability call:** `POST /api/projects` with `{"name":"Demo Weather API","openapi_json":{...}}` → project created, 4 endpoints discovered, readiness 62/100, repair rules generated, proxy normalizes `{"tmp":"31 C","desc":"sun"}` → `{"temperature_celsius":31,"condition":"sunny"}`
+- **Expected error behavior:** invalid spec → 400; unsafe method auto-test → `skipped`; unreachable upstream → `UPSTREAM_TIMEOUT` with `retryable:true`; bad proxy args → `INVALID_ARGUMENT`
+
+## Security and data handling
+
+- **Data collected:** Project specs and test metadata the reviewer submits; no end-user data.
+- **Purpose and retention:** Review/demo only, stored in local SQLite file.
+- **Third parties / outbound network calls:** Only the upstream API under test (reviewer-supplied URL), via httpx with SSRF guard.
+- **Secrets:** No secrets are committed. Review access is supplied only through an approved private channel when required.
+- **Known risks / restrictions:** Set `ALLOW_PRIVATE_NETWORK=true` only for local demo against localhost; keep `false` in production.
+
+## Support
+
+- **Team / builder:** shahadattest (solo)
+- **Contact:** via GitHub `shahadattest`
+- **License / rights:** MIT (see `source/LICENSE`); submitter authorizes review and archival per RIGHTS.md.

submissions/mcp-hackathon/shahadattest-mcp-doctor/source/.env.example

@@ -0,0 +1,10 @@
+PORT=8000
+DATABASE_URL=sqlite:///./mcp_doctor.db
+ALLOW_PRIVATE_NETWORK=false
+REQUEST_TIMEOUT=10
+MAX_RETRIES=2
+GIT_COMMIT=dev-local
+PROJECT_SLUG=team-mcp-doctor
+LLM_BASE_URL=
+LLM_API_KEY=
+LLM_MODEL=

submissions/mcp-hackathon/shahadattest-mcp-doctor/source/LICENSE

@@ -0,0 +1 @@
+MIT License — MCP Doctor (hackathon MVP).

submissions/mcp-hackathon/shahadattest-mcp-doctor/source/README.md

@@ -0,0 +1,56 @@
+# MCP Doctor
+
+**MCP Doctor turns messy or unreliable APIs into consistent, validated, agent-ready tools.**
+
+Give MCP Doctor an API. It tests the API, finds what makes it unreliable for AI agents, creates a normalized compatibility layer, validates the repaired interface, and generates an agent-ready tool.
+
+> Postman tests APIs. MCP Doctor prepares them for AI agents.
+
+## How it works
+
+Import → Test → Diagnose → Repair → Agentize → Retest → Generate tool. Before/after readiness score is the hero moment (e.g. 43 → 96).
+
+## Quick start (local)
+
+```bash
+cd mcp-doctor/backend
+pip install -r requirements.txt
+python -m uvicorn app.main:app --port 8000
+# demo api
+cd ../examples/broken-demo-api
+python -m uvicorn main:app --port 8001
+# open ../frontend/index.html (set backend http://localhost:8000)
+```
+
+Set `ALLOW_PRIVATE_NETWORK=true` for local demo testing against localhost.
+
+## Docker
+
+```bash
+cd mcp-doctor
+docker-compose up --build
+# frontend http://localhost:3000 backend http://localhost:8000/health demo http://localhost:8001/health
+```
+
+## API examples
+
+```bash
+curl http://localhost:8000/health
+curl -X POST http://localhost:8000/api/projects -H 'Content-Type: application/json' -d '{"name":"Demo","openapi_url":"http://demo-api:8001/openapi.json"}'
+```
+
+## Project structure
+
+See `docs/architecture.md`. Backend `backend/app/services/*`, demo `examples/broken-demo-api`, dashboard `frontend/`.
+
+## Security
+
+SSRF guard, timeout/retry, size limits, safe-method-only auto-test, no codegen execution, secrets via env. This is a compatibility tool, not a vulnerability scanner.
+
+## Limitations / Future
+
+Static dashboard (Next.js port later), repair simulation scoring, single-table SQLite, no auth/billing yet. Roadmap: drift detection, monitoring, self-healing adapters, MCP server export, pay-per-call.
+
+## License
+
+MIT (see LICENSE).

submissions/mcp-hackathon/shahadattest-mcp-doctor/source/backend/Dockerfile

@@ -0,0 +1,9 @@
+FROM python:3.12-slim
+WORKDIR /code
+COPY requirements.txt .
+RUN pip install --no-cache-dir -r requirements.txt
+COPY app ./app
+COPY tests ./tests
+ENV PORT=8000
+EXPOSE 8000
+CMD ["sh","-c","python -m uvicorn app.main:app --host 0.0.0.0 --port ${PORT:-8000}"]