---
title: "Security"
description: "Specs are treated as untrusted input, the engine never uses the network, and the MCP server writes to four paths only."
---

> Documentation Index
> Fetch the complete documentation index at: https://apiweld.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

Apiweld treats every OpenAPI spec as data from someone else. Most of what follows comes from that one rule.

## Specs are never run

Nothing in a spec is executed. Resolving references, walking schemas, and generating code only read the document's structure. The functions that fix a broken spec (`patch`) are TypeScript you wrote in your own `apiweld.config.ts`. They're never loaded from the spec.

A spec can only pull in `$ref`s from its own host, unless you allow other hosts with `allowRemoteHosts` in the config.

## The engine is offline

`apiweld-engine` never opens a network connection. The TypeScript side downloads the spec, saves it to a file, and gives the engine the path. Even a malicious spec can't turn the engine into a network client.

Engine binaries are built in GitHub Actions with goreleaser. The published SHA-256 checksums and npm provenance let you confirm the binary npm installed is the one CI built. If you set `APIWELD_ENGINE_PATH` to use your own binary, you're responsible for it.

## Downloads are verified

`apiweld catalog sync` rejects a catalog snapshot that doesn't match its published checksum. `catalog add` fetches only the URL you give it. `catalog build` doesn't use the snapshot at all and reads APIs.guru directly.

## Generated code is plain TypeScript

The generated client is ordinary source code in your `output` folder. It has no install scripts, and nothing in it runs until your own code calls it. Commit it and review it like the rest of your code. To remove an API, delete it from the config and regenerate.

## The MCP server has no network listener

`apiweld mcp` talks to your agent over stdin and stdout. It doesn't listen on a port. It can only write to the `output` folder, `apiweld.config.ts`, `apiweld.lock.json`, and `.apiweld/`. When an agent fixes call sites from a heal plan, it edits your code with its own permissions, the ones you already gave it, not through Apiweld.

## Drift logs record shapes, not data

With response validation on, `.apiweld/drift.log.jsonl` records the endpoint, the JSON path, the expected type, the received type, and a timestamp. It never records response values. The log is gitignored and stays on the machine that received the response.

## Your API keys stay yours

Apiweld never handles the credentials for the APIs you call. The spec's auth scheme tells the generated client and your agent that, say, a bearer token is required. You supply the token from your own environment, as you would with any other client. There's no Apiweld account to store it in.

Source: https://apiweld.dev/security/index.mdx