Apiweld treats every OpenAPI spec as data from someone else. Most of what follows comes from that one rule.
Specs are never run
Nothing in a spec is executed. Resolving references, walking schemas, and generating code only read the document’s structure. The functions that fix a broken spec (patch) are TypeScript you wrote in your own apiweld.config.ts. They’re never loaded from the spec.
A spec can only pull in $refs from its own host, unless you allow other hosts with allowRemoteHosts in the config.
The engine is offline
apiweld-engine never opens a network connection. The TypeScript side downloads the spec, saves it to a file, and gives the engine the path. Even a malicious spec can’t turn the engine into a network client.
Engine binaries are built in GitHub Actions with goreleaser. The published SHA-256 checksums and npm provenance let you confirm the binary npm installed is the one CI built. If you set APIWELD_ENGINE_PATH to use your own binary, you’re responsible for it.
Downloads are verified
apiweld catalog sync rejects a catalog snapshot that doesn’t match its published checksum. catalog add fetches only the URL you give it. catalog build doesn’t use the snapshot at all and reads APIs.guru directly.
Generated code is plain TypeScript
The generated client is ordinary source code in your output folder. It has no install scripts, and nothing in it runs until your own code calls it. Commit it and review it like the rest of your code. To remove an API, delete it from the config and regenerate.
The MCP server has no network listener
apiweld mcp talks to your agent over stdin and stdout. It doesn’t listen on a port. It can only write to the output folder, apiweld.config.ts, apiweld.lock.json, and .apiweld/. When an agent fixes call sites from a heal plan, it edits your code with its own permissions, the ones you already gave it, not through Apiweld.
Drift logs record shapes, not data
With response validation on, .apiweld/drift.log.jsonl records the endpoint, the JSON path, the expected type, the received type, and a timestamp. It never records response values. The log is gitignored and stays on the machine that received the response.
Your API keys stay yours
Apiweld never handles the credentials for the APIs you call. The spec’s auth scheme tells the generated client and your agent that, say, a bearer token is required. You supply the token from your own environment, as you would with any other client. There’s no Apiweld account to store it in.