# AIVP Services MCP Servers: Full Reference

> Source-grounded reference for ten standalone npm packages that expose Model Context Protocol tools over stdio and, with package-specific flags, local HTTP transports.

This document describes the checked-in package manifests, READMEs, tool registrations, implementations, and landing-page sources. It does not assert which revision is currently deployed.

## Site, runtime, installation, and license

### Canonical site

- Site: [https://aivp-mcp.vercel.app/](https://aivp-mcp.vercel.app/)
- Catalog: [https://aivp-mcp.vercel.app/#products](https://aivp-mcp.vercel.app/#products)
- Documentation: [https://aivp-mcp.vercel.app/docs.html](https://aivp-mcp.vercel.app/docs.html)
- Quick start: [https://aivp-mcp.vercel.app/docs.html#quickstart](https://aivp-mcp.vercel.app/docs.html#quickstart)
- FAQ: [https://aivp-mcp.vercel.app/faq.html](https://aivp-mcp.vercel.app/faq.html)
- Package comparison: [https://aivp-mcp.vercel.app/compare.html](https://aivp-mcp.vercel.app/compare.html)
- License-key recovery: [https://aivp-mcp.vercel.app/recover.html](https://aivp-mcp.vercel.app/recover.html)

### Common runtime facts

- All ten `package.json` files require Node.js 18 or newer, use ES modules, expose a command-line binary, and publish the compiled `dist` directory.
- All ten package manifests declare the MIT license.
- The default transport is stdio, suitable for an MCP client that launches a local command.
- Optional network modes are not uniform. Most packages use `--sse`; MCP Security Scanner uses `--http`; Data Aggregator accepts either `--sse` or `--http`. Some implementations expose legacy `/sse` plus `/messages` routes, while Data Aggregator, Legal Doc Analyzer, and API Doc Generator expose Streamable HTTP at `/mcp`.
- No global installation is required. Run a package with its exact `npx -y` command:

| Package | Command | Canonical package page |
|---|---|---|
| `ai-cost-analyzer` | `npx -y ai-cost-analyzer` | [AI Cost Analyzer](https://aivp-mcp.vercel.app/ai-cost-analyzer.html) |
| `mcp-server-security-scanner` | `npx -y mcp-server-security-scanner` | [MCP Security Scanner](https://aivp-mcp.vercel.app/mcp-server-security-scanner.html) |
| `data-aggregator-mcp` | `npx -y data-aggregator-mcp` | [Data Aggregator MCP](https://aivp-mcp.vercel.app/data-aggregator-mcp.html) |
| `market-data-analyzer` | `npx -y market-data-analyzer` | [Market Data Analyzer](https://aivp-mcp.vercel.app/market-data-analyzer.html) |
| `seo-audit-tool` | `npx -y seo-audit-tool` | [SEO Audit Tool](https://aivp-mcp.vercel.app/seo-audit-tool.html) |
| `mcp-schema-designer` | `npx -y mcp-schema-designer` | [MCP Schema Designer](https://aivp-mcp.vercel.app/mcp-schema-designer.html) |
| `social-media-analytics` | `npx -y social-media-analytics` | [Social Media Analytics](https://aivp-mcp.vercel.app/social-media-analytics.html) |
| `resume-optimizer` | `npx -y resume-optimizer` | [Resume Optimizer](https://aivp-mcp.vercel.app/resume-optimizer.html) |
| `legal-doc-analyzer` | `npx -y legal-doc-analyzer` | [Legal Doc Analyzer](https://aivp-mcp.vercel.app/legal-doc-analyzer.html) |
| `mcp-api-doc-generator` | `npx -y mcp-api-doc-generator` | [MCP API Doc Generator](https://aivp-mcp.vercel.app/mcp-api-doc-generator.html) |

A minimal MCP-client entry follows this shape:

```json
{
  "mcpServers": {
    "chosen-name": {
      "command": "npx",
      "args": ["-y", "exact-package-name"],
      "env": {
        "LICENSE_KEY": "your-purchased-key"
      }
    }
  }
}
```

Omit the `env` block when using the keyless trial or Data Aggregator free quota. Do not publish license keys, checkout session identifiers, or checkout links.

### Code-enforced access rules

- Every registered tool calls the shared license checker before its handler.
- Nine packages use a one-off allowance of **three tool calls total per package**, shared across all tools: AI Cost Analyzer, MCP Security Scanner, Market Data Analyzer, SEO Audit Tool, MCP Schema Designer, Social Media Analytics, Resume Optimizer, Legal Doc Analyzer, and MCP API Doc Generator.
- **Data Aggregator is the exception.** Its code selects a permanent **100 calls per UTC day** allowance instead of the one-off three-call trial. The allowance covers all six tools and resets when the ISO UTC date changes.
- Usage is normally persisted in `~/.aivp-mcp/usage.json`, so restarting a stdio process does not reset it. `AIVP_USAGE_DIR` changes that directory. If the filesystem is unavailable, the implementation falls back to process memory.
- Purchased keys are read from `LICENSE_KEY`, with `AIVP_LICENSE_KEY` as a fallback. They are signature-verified locally, checked for product and expiry, and may carry a plan tier. No signing key or private key material is documented here.
- Supplying an invalid or expired key returns an error; it does not fall back to keyless usage.
- For tier-tagged entry licenses, these tools are restricted by the runtime:

| Product | Higher-tier-only tools in code |
|---|---|
| Market Data Analyzer | `analyze_portfolio`, `compare_assets`, `crypto_analysis` |
| SEO Audit Tool | `check_links`, `compare_pages` |
| MCP Schema Designer | `migrate_schema`, `optimize_queries` |
| Social Media Analytics | `generate_content_calendar`, `analyze_competitors` |
| Resume Optimizer | `optimize_for_job`, `generate_summary`, `analyze_keywords` |
| Legal Doc Analyzer | `compare_versions`, `check_compliance` |
| MCP API Doc Generator | `generate_sdk`, `generate_tests` |

AI Cost Analyzer, MCP Security Scanner, and Data Aggregator have no tool-level tier restrictions in the shared table. Keyless allowances are checked in a separate branch and can be spent on any registered tool.

### Recovery

The checked-in recovery page accepts either the success-page checkout URL or its Stripe checkout session identifier, then requests `/api/license`. The server-side endpoint decides whether a key is available. Treat the checkout value as a bearer capability and keep the returned license key private. The canonical recovery link above is provided without claiming that the checked-in recovery revision is the revision currently served.

## 1. AI Cost Analyzer

- **Package:** `ai-cost-analyzer`
- **Install:** `npx -y ai-cost-analyzer`
- **Canonical page:** [https://aivp-mcp.vercel.app/ai-cost-analyzer.html](https://aivp-mcp.vercel.app/ai-cost-analyzer.html)

### Purpose

Analyzes caller-supplied LLM usage records, estimates possible savings, rewrites prompt text heuristically, and compares bundled model cost and suitability data. It does not connect to an AI provider billing account.

### Exact tools and key inputs

- `analyze_usage` — Computes cost breakdowns, per-request averages, estimated token waste, and time trends. Input: `usage_data` (required array). Each record requires `model`, non-negative integer `input_tokens`, non-negative integer `output_tokens`, and an ISO-8601 `timestamp`; optional fields are `cached_tokens`, `tool_definitions`, and `system_prompt_tokens`.
- `estimate_savings` — Projects caching, routing, and context-pruning savings from the same `usage_data` records. Optional `monthly_multiplier` is a number of at least 1 and defaults to 1.
- `optimize_prompt` — Reviews prompt and tool-definition text. Inputs: `system_prompt` (required string), `tool_definitions` (required array of JSON or plain-text strings), optional positive-integer `requests_per_month` (default 10,000), and optional `model` (default `claude-sonnet`).
- `compare_models` — Compares bundled cost and suitability metadata for a described task. Input: required `task_description`; optional positive integers `estimated_input_tokens` and `estimated_output_tokens`.
- `get_pricing` — Returns the bundled pricing table. It takes no input.

### Three grounded use cases

1. Feed exported request-level token counts to `analyze_usage`, then group the resulting costs and estimated waste by model.
2. Use `estimate_savings` on a representative sample and use `optimize_prompt` on the corresponding system prompt and tool definitions.
3. Use `compare_models` for a described workload and inspect the same bundled rates directly with `get_pricing`.

### Scope and exclusions

- `src/tools/pricing.ts` labels the bundled prices as a **March 2026 snapshot**. `get_pricing` does not fetch live provider pricing.
- Prompt token counts use an approximation of roughly four characters per token; savings calculations apply coded assumptions rather than measuring a deployed workload.
- Model suitability and quality labels are static rules, not results from benchmark execution.
- No billing ingestion, provider authentication, request proxying, or automatic production configuration change is implemented.

## 2. MCP Security Scanner

- **Package:** `mcp-server-security-scanner`
- **Install:** `npx -y mcp-server-security-scanner`
- **Canonical page:** [https://aivp-mcp.vercel.app/mcp-server-security-scanner.html](https://aivp-mcp.vercel.app/mcp-server-security-scanner.html)

### Purpose

Performs static, rule-based review of MCP configuration files, tool definitions, authentication settings, and a bundled CVE record set. It can combine findings into a Markdown report.

### Exact tools and key inputs

- `scan_config` — Reads and scans an MCP configuration file. Input: required `configPath`, which may be absolute or relative.
- `scan_tool_definitions` — Reviews tool metadata for injection, broad-access, command, and exfiltration patterns. Input: required `tools` array; each item requires `name` and may include `description` and an `inputSchema` object.
- `check_cves` — Matches package names and optional versions against the bundled records. Input: required `servers` array of `{name, version?}` and optional boolean `listAll`. When `listAll` is true, the full bundled set is returned.
- `validate_auth` — Reviews an `authConfig` object. Useful fields include `type`; nested `oauth` fields such as `clientId`, `clientSecret`, URLs, scopes, PKCE, token storage, expiry, and refresh-token rotation; nested `apiKey` fields; and nested `bearer` fields. Selected OAuth fields are also accepted flat in camelCase or snake_case.
- `generate_report` — Builds a report from an optional direct `findings` array and/or structured `configScan`, `toolScan`, `cveCheck`, and `authValidation` results.

### Three grounded use cases

1. Run `scan_config` against a Claude Desktop or project MCP configuration before sharing it.
2. Pass a server's advertised tool schemas to `scan_tool_definitions`, then separately review its auth settings with `validate_auth`.
3. Check named packages with `check_cves` and merge all prior findings through `generate_report`.

### Scope and exclusions

- The scanner uses regexes, structural checks, local file parsing, and a static bundled database. It does not perform exploit execution, dynamic penetration testing, network discovery, or a live vulnerability-feed lookup.
- The current source array contains 18 CVE records. A match is limited to the package names and version comparisons encoded in that array.
- The generated SOC 2 checklist maps findings to selected criteria; it is not an audit, attestation, or certification.
- A clean result only means no shipped rule matched the supplied material.

## 3. Data Aggregator MCP

- **Package:** `data-aggregator-mcp`
- **Install:** `npx -y data-aggregator-mcp`
- **Canonical page:** [https://aivp-mcp.vercel.app/data-aggregator-mcp.html](https://aivp-mcp.vercel.app/data-aggregator-mcp.html)

### Purpose

Combines six public-data tools: stocks and crypto, webpage extraction, news, weather, currency conversion, and selected public-data lookups. It is the only package with the code-enforced permanent 100-calls-per-day keyless quota.

### Exact tools and key inputs

- `query_stocks` — Fetches a stock or cryptocurrency quote. Input: required `symbol`; optional `type` is `stock`, `crypto`, or `auto` (default `auto`).
- `fetch_webpage` — Fetches a URL and extracts title, description, headings, text, and links. Input: required URL `url`; optional `selector` supports one basic tag, `.class`, or `#id` selector.
- `search_news` — Searches NewsAPI when configured or Google News RSS otherwise. Optional inputs: `query`, `category` (`business`, `entertainment`, `general`, `health`, `science`, `sports`, or `technology`), `source`, `language` (default `en`), `from`, `to`, and integer `maxResults` from 1 to 100 (default 10). Category and date filters are NewsAPI-specific.
- `query_weather` — Returns current conditions and a seven-day Open-Meteo forecast. Provide `city` or both `latitude` and `longitude`; optional `units` is `celsius` or `fahrenheit` (default `celsius`).
- `query_exchange_rates` — Converts currency. Inputs: required `base` and `target`, optional positive `amount` (default 1), and optional `date` in `YYYY-MM-DD` form for historical fiat rates.
- `query_public_data` — Runs one of four commands. Required `command` is `wikipedia`, `ip_geolocation`, `dns_lookup`, or `expand_url`. Command-specific optional fields are `query`, `language` (default `en`), `ip`, `domain`, `recordType` (`A`, `AAAA`, `MX`, `TXT`, `NS`, `CNAME`, or `SOA`; default `A`), and `url`.

Optional environment variables are `NEWS_API_KEY` for NewsAPI and `ALPHA_VANTAGE_KEY` for a stock-data fallback.

### Three grounded use cases

1. Query a stock or cryptocurrency with `query_stocks`, then convert a value with `query_exchange_rates`.
2. Combine `query_weather` and `search_news` for a location- or topic-oriented research brief.
3. Extract a page with `fetch_webpage`, or use `query_public_data` for a Wikipedia summary, IP lookup, DNS records, or URL expansion.

### Scope and exclusions

- Results depend on external endpoints including Yahoo Finance, CoinGecko, Google News RSS or NewsAPI, Open-Meteo, Frankfurter, Wikipedia, and public DNS/IP services.
- Caches and rate limiters are in memory. Source-specific limits, endpoint availability, and cached values can affect freshness.
- Webpage parsing is regex-based and does not execute client-side JavaScript. Its selector support is intentionally limited to one tag, class, or id.
- Historical exchange dates are implemented for fiat flows, not historical crypto conversion.
- The runtime does not implement the one-off three-call trial for this product; it selects the 100-per-UTC-day branch.

## 4. Market Data Analyzer

- **Package:** `market-data-analyzer`
- **Install:** `npx -y market-data-analyzer`
- **Canonical page:** [https://aivp-mcp.vercel.app/market-data-analyzer.html](https://aivp-mcp.vercel.app/market-data-analyzer.html)

### Purpose

Fetches Yahoo Finance and CoinGecko data for stock indicators, a fixed-universe stock screen, portfolio calculations, multi-asset comparisons, a market snapshot, and cryptocurrency analysis.

### Exact tools and key inputs

- `analyze_stock` — Input: required stock `symbol`. Computes price context, SMA 20/50/200, RSI, MACD, support/resistance, and crossover signals.
- `screen_stocks` — All filters are optional: `min_market_cap`, `max_market_cap`, `min_pe`, `max_pe`, partial-match `sector`, `min_volume`, `min_price`, `max_price`, and integer `limit` from 1 to 50 (default 25).
- `analyze_portfolio` — Input: non-empty `holdings` array; each holding requires `symbol`, numeric `shares`, and numeric `avg_cost`. Returns value, P&L, allocation, sector, concentration, and diversification calculations.
- `compare_assets` — Inputs: `symbols` containing 2-5 tickers and optional `period` of `1mo`, `3mo`, `6mo`, `1y`, `2y`, or `5y` (default `6mo`).
- `market_overview` — Takes no input and requests predefined indices, sector ETFs, volatility, crypto, and commodity symbols.
- `crypto_analysis` — Input: required cryptocurrency `symbol` or name.

The first two tools and `market_overview` have no tool-level tier restriction. The runtime marks `analyze_portfolio`, `compare_assets`, and `crypto_analysis` as higher-tier-only for an entry-tier key.

### Three grounded use cases

1. Inspect one ticker with `analyze_stock`, then narrow the built-in universe with `screen_stocks`.
2. Calculate current allocation and P&L with `analyze_portfolio`, then compare 2-5 symbols over a selected period with `compare_assets`.
3. Pair the broad `market_overview` snapshot with `crypto_analysis` for a named cryptocurrency.

### Scope and exclusions

- The stock screener operates on the 69 symbols listed in source; it is not a whole-market screener.
- Yahoo Finance access uses unofficial endpoints with cookie-and-crumb authentication. CoinGecko uses its public API. Availability and rate limits are outside the package's control.
- Price data is cached in memory for five minutes.
- Sharpe ratios and the crypto fear/greed value are explicitly approximations. The source does not implement Bollinger Band or VaR output.
- There is no brokerage connection, order entry, or portfolio custody; the package only returns computed research output.

## 5. SEO Audit Tool

- **Package:** `seo-audit-tool`
- **Install:** `npx -y seo-audit-tool`
- **Canonical page:** [https://aivp-mcp.vercel.app/seo-audit-tool.html](https://aivp-mcp.vercel.app/seo-audit-tool.html)

### Purpose

Fetches and parses HTML or XML to score page-level SEO checks, analyze supplied text, inspect links and sitemaps, and compare two pages.

### Exact tools and key inputs

- `audit_page` — Input: required URL `url`. Reviews title, meta description, headings, image alt coverage, links, byte size, viewport metadata, structured data, canonical tags, and social metadata.
- `analyze_keywords` — Input: required non-empty plain-text `text`. Produces one-, two-, and three-word frequencies, density, a single-document TF-IDF approximation, and suggestions.
- `check_links` — Input: required URL `url`. Fetches the page, deduplicates links, and checks up to 100 links with concurrency 10.
- `analyze_sitemap` — Input: required sitemap URL `url`. Parses sitemap or sitemap-index XML, checks duplicates and dates, and summarizes URL patterns.
- `compare_pages` — Inputs: required URLs `url_a` and `url_b`. Fetches both and compares the metrics used by its scoring rules.

The runtime marks `check_links` and `compare_pages` as higher-tier-only for an entry-tier key.

### Three grounded use cases

1. Run `audit_page` on a page and use its categorized issues to prioritize HTML changes.
2. Analyze article copy with `analyze_keywords`, then validate the site's XML inventory with `analyze_sitemap`.
3. Check a page's outbound and internal links with `check_links`, or compare two candidate pages with `compare_pages`.

### Scope and exclusions

- The implementation uses Node fetch and regex-oriented HTML parsing, not a browser or JavaScript renderer.
- Network requests use a 15-second timeout. Link checking caps work at 100 unique links and reports only the checked set.
- Keyword TF-IDF is a single-document approximation. No search-volume, ranking, backlink, Search Console, Core Web Vitals, or readability service is queried.
- The 0-100 score is the package's own deterministic rule set, not a search-engine score.

## 6. MCP Schema Designer

- **Package:** `mcp-schema-designer`
- **Install:** `npx -y mcp-schema-designer`
- **Canonical page:** [https://aivp-mcp.vercel.app/mcp-schema-designer.html](https://aivp-mcp.vercel.app/mcp-schema-designer.html)

### Purpose

Generates and inspects PostgreSQL-oriented schema text. It can produce CREATE TABLE SQL, validation findings, migrations, TypeScript/Zod/JSON Schema output, and query suggestions without connecting to a database.

### Exact tools and key inputs

- `design_schema` — Required natural-language `description`; optional `tables`. Each table requires `name` and `columns`; each column requires `name` and SQL `type`, with optional `nullable`, `primary`, `unique`, and `references` in `table.column` form.
- `validate_schema` — Input: required PostgreSQL CREATE TABLE text in `sql`.
- `migrate_schema` — Inputs: required current schema `from_sql` and target schema `to_sql`.
- `generate_types` — Inputs: required schema `sql` and required `format` of `typescript`, `zod`, or `json-schema`.
- `optimize_queries` — Inputs: required SQL `query` and required schema text under the registered parameter name `schema`.

The runtime marks `migrate_schema` and `optimize_queries` as higher-tier-only for an entry-tier key.

### Three grounded use cases

1. Describe an e-commerce or other supported domain to `design_schema`, then inspect its PostgreSQL SQL, ERD text, and index suggestions.
2. Pass existing CREATE TABLE statements to `validate_schema`, and diff two schema versions with `migrate_schema`.
3. Generate application types with `generate_types`, or review one query against schema context with `optimize_queries`.

### Scope and exclusions

- The parser is regex-based and targets PostgreSQL CREATE TABLE syntax.
- The package generates text only: it does not connect to a database, inspect real statistics or query plans, apply migrations, or execute SQL.
- Typed output is limited to TypeScript interfaces, Zod schemas, and JSON Schema draft 2020-12.
- MySQL, SQLite, Python, Go, and Rust generation is not implemented in this source.

## 7. Social Media Analytics

- **Package:** `social-media-analytics`
- **Install:** `npx -y social-media-analytics`
- **Canonical page:** [https://aivp-mcp.vercel.app/social-media-analytics.html](https://aivp-mcp.vercel.app/social-media-analytics.html)

### Purpose

Applies public-page scraping and local heuristics to supported social profile URLs, hashtag text, content-calendar inputs, competitor profiles, and proposed post text.

### Exact tools and key inputs

- `analyze_profile` — Input: required profile `url`. URL detection supports Twitter/X, Instagram, YouTube, LinkedIn, and TikTok.
- `analyze_hashtags` — Input: required `hashtags` string array and optional `platforms` string array. Recognized platform values are the five supported platforms; omission uses all.
- `generate_content_calendar` — Inputs: required `niche`, optional `platforms` (default Twitter, LinkedIn, and Instagram), and optional integer `posts_per_week` from 1 to 14 (default 5).
- `analyze_competitors` — Input: `competitors`, an array of 2-5 profile URLs or handles.
- `viral_score` — Input: required post `text` and optional target `platform`.

The runtime marks `generate_content_calendar` and `analyze_competitors` as higher-tier-only for an entry-tier key.

### Three grounded use cases

1. Review one public profile with `analyze_profile` and compare 2-5 public profiles with `analyze_competitors`.
2. Explore supplied tags with `analyze_hashtags`, then score draft post text with `viral_score`.
3. Generate a 30-day, platform-oriented schedule from a niche and posting frequency with `generate_content_calendar`.

### Scope and exclusions

- Profile fetching is basic HTML scraping without official social-platform API credentials or account connections.
- When live scraping fails or parsing does not yield enough data, the implementation creates deterministic estimated profile values from the handle and built-in platform benchmarks. Output identifies this fallback.
- Hashtag volumes, engagement rates, posting times, viral scores, and content recommendations are heuristic estimates, not platform analytics or forecasts.
- No heatmap renderer, post publishing, ad management, private-account access, or guarantee of reach is implemented.

## 8. Resume Optimizer

- **Package:** `resume-optimizer`
- **Install:** `npx -y resume-optimizer`
- **Canonical page:** [https://aivp-mcp.vercel.app/resume-optimizer.html](https://aivp-mcp.vercel.app/resume-optimizer.html)

### Purpose

Runs local text rules over resume content and optional job text to produce scores, keyword inventories, matching suggestions, bullet feedback, generated summary variants, and ATS-oriented formatting checks.

### Exact tools and key inputs

- `analyze_resume` — Input: required `resume_text`; optional `job_description`.
- `optimize_for_job` — Inputs: required `resume_text` and required `job_description`.
- `generate_summary` — Input: required `resume_text`; optional `target_role`.
- `improve_bullets` — Input: required `bullets` string array; optional role or industry `context`.
- `check_ats` — Input: required `resume_text`.
- `analyze_keywords` — Input: required `resume_text`; optional `industry`, with built-in data for tech, finance, marketing, healthcare, and general use.

The runtime marks `optimize_for_job`, `generate_summary`, and `analyze_keywords` as higher-tier-only for an entry-tier key.

### Three grounded use cases

1. Run `analyze_resume` for the package's 0-100 breakdown and `check_ats` for categorized text-format findings.
2. Compare resume text with a job description through `optimize_for_job`, then inspect industry terms with `analyze_keywords`.
3. Review individual bullets with `improve_bullets` and produce three template-driven summary styles with `generate_summary`.

### Scope and exclusions

- Inputs are plain text. The package does not parse PDF, DOCX, images, typography, columns, or visual page layout.
- Analysis and generation are deterministic heuristics and templates; no external API or LLM is called.
- Scores are package-defined signals, not results from an employer's ATS.
- It does not submit applications or guarantee ATS passage, interviews, or hiring outcomes.

## 9. Legal Doc Analyzer

- **Package:** `legal-doc-analyzer`
- **Install:** `npx -y legal-doc-analyzer`
- **Canonical page:** [https://aivp-mcp.vercel.app/legal-doc-analyzer.html](https://aivp-mcp.vercel.app/legal-doc-analyzer.html)

### Purpose

Uses local text patterns to identify contract structure, flag selected risks, compare versions, summarize terms, and check for selected contractual language associated with GDPR, CCPA, SOC 2, and HIPAA.

### Exact tools and key inputs

- `analyze_contract` — Input: required `document_text`; optional `document_type` of `nda`, `employment`, `saas`, `freelance`, `lease`, or `general`. Omission triggers text-based type detection.
- `find_risks` — Input: required `document_text`.
- `compare_versions` — Inputs: required `old_version` and `new_version`; optional `labels` object containing `old` and `new`.
- `generate_summary` — Input: required `document_text`.
- `check_compliance` — Input: required `document_text`; optional `frameworks` array containing any of `gdpr`, `ccpa`, `soc2`, and `hipaa`. Omission checks all four.

The runtime marks `compare_versions` and `check_compliance` as higher-tier-only for an entry-tier key.

### Three grounded use cases

1. Extract parties, dates, obligations, liability language, termination terms, and governing-law text with `analyze_contract`, then inspect selected risks with `find_risks`.
2. Compare an original and revised draft with `compare_versions` to identify added, removed, and modified sections under its similarity rules.
3. Produce a plain-language structure with `generate_summary`, then check selected framework clauses with `check_compliance`.

### Scope and exclusions

- The implementation uses regexes, sentence splitting, similarity rules, clause patterns, and framework checklists. It does not call an external LLM or legal database.
- Framework scores indicate matching language in the built-in checklist; they do not establish legal compliance, certification, or regulatory approval.
- Version comparison is text-oriented and is not a redline engine for document files or formatting.
- Every tool output is informational only, does not constitute legal advice, and should not replace review by a qualified attorney.

## 10. MCP API Doc Generator

- **Package:** `mcp-api-doc-generator`
- **Install:** `npx -y mcp-api-doc-generator`
- **Canonical page:** [https://aivp-mcp.vercel.app/mcp-api-doc-generator.html](https://aivp-mcp.vercel.app/mcp-api-doc-generator.html)

### Purpose

Transforms compact endpoint definitions into OpenAPI 3.1 output, endpoint Markdown, a TypeScript client, and Jest or Vitest source; it also performs rule-based checks on OpenAPI text.

### Shared endpoint shape

An endpoint requires `method` and `path`. It may include `name`, `description`, `parameters`, `request_body`, `response`, `auth_type`, and `tags`.

- Each parameter requires `name`, `in` (`query`, `path`, `header`, or `cookie`), and `type`; `required` and `description` are optional.
- A request body requires `type` and a `properties` map; `required` field names are optional.
- A response requires `type` and a `properties` map; `status` defaults to 200 and `description` is optional.
- Each property requires `type`; optional metadata includes `description`, `format`, and string `enum`.
- `auth_type`, when present, is `bearer`, `api_key`, `basic`, or `none`.

### Exact tools and key inputs

- `generate_openapi` — Input: required `endpoints`; optional `info` whose supplied value requires `title` and `version` and may include `description` and `base_url`; optional `format` is `yaml` or `json` (default `yaml`).
- `document_endpoint` — Required `method`, `path`, and `description`; optional `parameters`, `request_body`, `response`, `auth_type`, and `tags`.
- `generate_sdk` — Input: required `endpoints`; optional `base_url` (default `https://api.example.com`).
- `validate_api` — Input: required `spec` containing OpenAPI YAML or JSON text.
- `generate_tests` — Input: required `endpoints`; optional `framework` is `jest` or `vitest` (default `vitest`).

The runtime marks `generate_sdk` and `generate_tests` as higher-tier-only for an entry-tier key.

### Three grounded use cases

1. Describe several endpoints once and pass them to `generate_openapi` for YAML or JSON OpenAPI 3.1 output.
2. Generate human-oriented Markdown for one operation with `document_endpoint`, then produce a TypeScript client with `generate_sdk`.
3. Check pasted OpenAPI text with `validate_api`, or generate Jest/Vitest source from endpoint definitions with `generate_tests`.

### Scope and exclusions

- The package emits source text; it does not write a project, compile an SDK, run generated tests, call the described API, or verify generated examples against a service.
- SDK generation is TypeScript-only. Test generation is Jest- or Vitest-only.
- `validate_api` parses JSON and a basic in-house YAML subset, then applies package rules. It is not a full OpenAPI conformance implementation.
- Endpoint schemas expose a deliberately compact type model and do not represent every OpenAPI or JSON Schema feature.

## Documentation links

- [Home and catalog](https://aivp-mcp.vercel.app/)
- [Documentation](https://aivp-mcp.vercel.app/docs.html)
- [Quick start](https://aivp-mcp.vercel.app/docs.html#quickstart)
- [Package comparison](https://aivp-mcp.vercel.app/compare.html)
- [FAQ](https://aivp-mcp.vercel.app/faq.html)
- [License-key recovery](https://aivp-mcp.vercel.app/recover.html)
- [Concise LLM index](https://aivp-mcp.vercel.app/llms.txt)

## Source basis and discrepancies

### Sources used

- `CLAUDE.md` repository facts and operational cautions.
- The ten package `README.md` files.
- The ten package `package.json` files.
- Every package's `src/index.ts`, shared `src/license.ts`, and relevant implementations under `src/tools`, `src/utils`, `src/data`, and `src/templates`.
- `landing-page/index.html`, `landing-page/docs.html`, `landing-page/compare.html`, `landing-page/recover.html`, and the ten canonical package pages.

When prose conflicted with executable code, this reference follows the registered tool schemas, implementations, license checker, and package manifests.

### Material discrepancies normalized in this reference

- Data Aggregator's license code chooses its 100-per-day no-key quota **instead of** the shared one-off three-call branch used by the other nine packages.
- Resume Optimizer's README says there are five tools, but `src/index.ts` registers six; `analyze_keywords` is the sixth and is documented here.
- MCP Security Scanner's README says its bundled database contains 20 CVEs, while the checked-in `CVE_DATABASE` array contains 18.
- AI Cost Analyzer prose calls pricing “live” or “current,” while `src/tools/pricing.ts` identifies a static March 2026 snapshot.
- MCP Schema Designer's README example calls the `optimize_queries` schema argument `schema_sql`; the registered MCP input name is `schema`.
- Data Aggregator's README combines the Stripe monthly-plan table with a later pay-per-query/MCPize section. No pay-per-query runtime behavior exists in the package, so this reference makes no such pricing claim.
- Several READMEs say keys are emailed instantly, while repository operations notes state that the email channel rejects non-owner recipients until a sending domain is verified. This reference makes no email-delivery guarantee.
- Repository operations notes record that the checked-in recovery page and the then-observed production deployment differed. Recovery links here are canonical links, not a claim about current deployment bytes.
- Manifest versions and MCP server metadata versions differ: package manifests are 1.1.4 except Market Data Analyzer 2.1.4, while server metadata is generally 1.0.0, with Security Scanner 1.0.1 and Market Data Analyzer 2.0.0. This reference therefore does not present the internal server metadata as the npm package version.