| description | All 134 planned items, each carrying evidence -- a command, a module, a rule prefix, a CI step -- that is re-checked on every build. |
|---|
The 134-item roadmap, held against the code that implements it.
A roadmap is the easiest document in a repository to be wrong: items get ticked from
memory, a refactor renames the command a row describes, and the table goes on saying
"done" about a capability that left. This page is generated by
scripts/check_roadmap.py, which checks every claim against the code and fails CI
when one stops being true.
128 of 134 implemented. 6 need an action only an account owner can take; they are listed at the end with what is prepared for them.
Every row below carries evidence — a command, a module, a rule prefix, a file, a CI step — that is true only while the thing exists. scripts/check_roadmap.py --check runs in CI, so this page and the code cannot disagree.
20 of 20.
| ID | Feature | Evidence |
|---|---|---|
AGENT-01 |
MCP tool manifest as a spec plugin | ✅ mcp format, apiverity.specs.mcp.manifest |
AGENT-02 |
BRK-MCP-* breaking-change taxonomy | ✅ BRK-MCP-* |
AGENT-03 |
Declared-vs-live tool drift | ✅ apiverity.runtime.mcp_drift, MCP-DRIFT-*, --base-url on drift |
AGENT-04 |
MCP spec conformance (MCP-CONF-*) | ✅ MCP-CONF-* |
AGENT-05 |
Per-connection tool-set stability probe | ✅ MCP-CONF-LIST-UNSTABLE* |
AGENT-06 |
Opt-in tools/call probing | ✅ apiverity.runtime.mcp_invoke, --execute on drift |
AGENT-07 |
Tool-description poisoning detection | ✅ apiverity.security.mcp_poisoning, MCP-POISON-*, docs/mcp-poisoning.md |
AGENT-08 |
Annotation-integrity checks | ✅ MCP-ANNOTATION-* |
AGENT-09 |
Shadow MCP server discovery | ✅ MCP-SHADOW-*, apiverity mcp-inventory |
AGENT-10 |
MCP auth posture check | ✅ apiverity.runtime.mcp_auth, MCP-AUTH-* |
AGENT-11 |
MCP fleet inventory & posture dashboard | ✅ docs/mcp-inventory.md, web/src/pages/agents.tsx |
AGENT-12 |
Baseline lockfile + signature | ✅ apiverity mcp-lock, MCP-LOCK-*, docs/mcp-lock.md |
AGENT-13 |
apiverity as an MCP server | ✅ apiverity.mcp.server, docs/mcp-exposure.md |
AGENT-14 |
Agent-facing AGENTS.md skill installer | ✅ apiverity agent-setup, apiverity.agents.skill |
AGENT-15 |
OWASP MCP Top-10 mapping report | ✅ apiverity.reports.compliance, MCP01 in docs/compliance-mapping.md |
AGENT-16 |
OWASP ASI (Agentic) Top-10 mapping | ✅ ASI01 in docs/compliance-mapping.md |
AGENT-17 |
Agent call-budget & rate governance | ✅ apiverity budget, BUDGET-*, docs/call-budgets.md |
AGENT-18 |
Tool-surface semantic versioning advisor | ✅ --suggest-version on breaking |
AGENT-19 |
Legacy/Modern MCP era tolerance | ✅ MCP-DRIFT-LEGACY-SERVER*, MCP-PROTOCOL-ERA-UNOBSERVED* |
AGENT-20 |
Agent trajectory hand-off to tooltrace-bench | ✅ apiverity agent-tasks, apiverity.agents.tasks, schemas/vendor/tooltrace-task-2026-09-11.schema.json, docs/agent-tasks.md |
12 of 12.
| ID | Feature | Evidence |
|---|---|---|
SPEC-01 |
OpenAPI 3.2.0 support | ✅ 3.2 in apiverity/specs/openapi/parser.py, 3.2 in docs/spec-support.md |
SPEC-02 |
Streaming media types (itemSchema / prefixEncoding / itemEncoding) | ✅ itemSchema in apiverity/specs/openapi/parser.py, itemEncoding in apiverity/specs/openapi/parser.py, BRK-STREAM-*, docs/streaming.md |
SPEC-03 |
query method + additionalOperations | ✅ additionalOperations in apiverity/specs/openapi/parser.py |
SPEC-04 |
querystring parameter location | ✅ apiverity.core.model.ParameterLocation, QUERYSTRING in apiverity/core/model.py |
SPEC-05 |
Hierarchical tags (summary/parent/kind) | ✅ SPEC-TAG-PARENT-UNKNOWN* |
SPEC-06 |
OAuth 2.0 device flow + oauth2MetadataUrl | ✅ oauth2MetadataUrl in apiverity/specs/openapi/parser.py, deviceAuthorization in apiverity/specs/openapi/parser.py |
SPEC-07 |
Arazzo workflow spec import/export | ✅ apiverity.stateful.arazzo, docs/arazzo.md, schemas/vendor/arazzo-1.1-2026-04-15.schema.json |
SPEC-08 |
Canonicalization pass | ✅ apiverity.core.canonical |
SPEC-09 |
External $ref bundler | ✅ apiverity.specs.bundle, SPEC-REF-* |
SPEC-10 |
JSON Schema 2020-12 keyword completeness | ✅ BRK-DEPENDENT-*, BRK-TUPLE-*, BRK-PATTERN-PROPERTIES-*, BRK-CONDITIONAL-* |
SPEC-11 |
GraphQL federation / supergraph diffing | ✅ apiverity federation, FED-*, docs/federation.md |
SPEC-12 |
SOAP/WSDL lane | ✅ wsdl format, BRK-SOAP-*, SPEC-WSDL-* |
12 of 12.
| ID | Feature | Evidence |
|---|---|---|
RULE-01 |
explain | ✅ apiverity explain, docs/check-rules.md |
RULE-02 |
--suggest-version advisor | ✅ --suggest-version on breaking |
RULE-03 |
Plain-English change summaries | ✅ apiverity.rules.summary, --summary on breaking |
RULE-04 |
Rule-pack registry & sharing | ✅ apiverity.rules.packs_registry, --packs on rules, docs/rule-packs.md, examples/plugins/apiverity-house-rules/pyproject.toml |
RULE-05 |
Custom policy DSL maturity | ✅ apiverity.rules.dsl, --policy-file on validate, docs/policy-dsl.md |
RULE-06 |
Deprecation lifecycle + RFC 8594 | ✅ apiverity.rules.lifecycle, LIFECYCLE-* |
RULE-07 |
Approved-diff workflow hardening | ✅ apiverity.rules.suppressions, SUPPRESSION-* |
RULE-08 |
Rule autofix suggestions | ✅ apiverity.rules.alternatives, --suggest-fix on breaking |
RULE-09 |
Severity profiles | ✅ apiverity.rules.profiles, --profile |
RULE-10 |
Cross-protocol rule parity matrix | ✅ apiverity.rules.parity, docs/rule-parity.md, scripts/generate_rule_parity.py |
RULE-11 |
Consumer-aware severity | ✅ apiverity.rules.consumers, --severity-by-consumers on breaking |
RULE-12 |
Rule benchmark vs oasdiff | ✅ scripts/benchmark_oasdiff.py, docs/benchmark.md, data/benchmark-oasdiff.json |
14 of 14.
| ID | Feature | Evidence |
|---|---|---|
RUN-01 |
Live-traffic capture (proxy) | ✅ apiverity capture, apiverity.traffic.capture, docs/capture.md |
RUN-02 |
First-seen/last-seen on drift findings | ✅ first_seen in apiverity/runtime/findings.py |
RUN-03 |
Unified drift finding shape | ✅ apiverity.runtime.findings |
RUN-04 |
Shadow contract inference | ✅ apiverity infer, apiverity.specs.infer, docs/inferred-contracts.md |
RUN-05 |
Ghost-route auditor | ✅ apiverity ghosts, GHOST-*, docs/ghost-routes.md |
RUN-06 |
Framework adapters | ✅ apiverity app, apiverity.specs.app, docs/framework-adapters.md |
RUN-07 |
OTel GenAI semantic conventions | ✅ apiverity.exporters.semconv, gen_ai in apiverity/exporters/semconv.py |
RUN-08 |
Trace-correlated drift | ✅ trace_id in apiverity/exporters/otel.py |
RUN-09 |
Drift timeline per operation | ✅ apiverity.runtime.drift_trend, --baseline on drift, --save-baseline on drift |
RUN-10 |
Concurrency curves in performance | ✅ apiverity.performance.curve, docs/load-shapes.md |
RUN-11 |
Response-size & TLS timing breakdown | ✅ apiverity.performance.connection |
RUN-12 |
Synthetic monitoring mode | ✅ apiverity monitor, apiverity.runtime.monitor, docs/monitoring.md |
RUN-13 |
Semantic drift (behaviour, not schema) | ✅ apiverity.runtime.semantic, SEMANTIC-*, docs/behavioural-drift.md |
RUN-14 |
eBPF zero-instrumentation capture (evaluate) | ✅ docs/ebpf-evaluation.md |
16 of 16.
| ID | Feature | Evidence |
|---|---|---|
SEC-01 |
Secret/credential leakage scanning on responses | ✅ apiverity.security.leakage, SEC-RESPONSE-CREDENTIAL* |
SEC-02 |
Spec-level security lint expansion | ✅ apiverity.security.checks, SEC-* |
SEC-03 |
BOLA/BFLA authorization probes | ✅ apiverity.security.authz, AUTHZ-*, docs/authorization.md |
SEC-04 |
OWASP API Top-10 mapped reports | ✅ ` |
SEC-05 |
SOC 2 / ISO 42001 / DORA evidence export | ✅ apiverity evidence, apiverity.reports.evidence, docs/evidence.md |
SEC-06 |
EU AI Act agent-activity evidence | ✅ docs/evidence.md, EU AI Act in docs/evidence.md |
SEC-07 |
PII detection & redaction hardening | ✅ apiverity.security.pii, docs/pii.md |
SEC-08 |
Payload guardrails | ✅ apiverity.security.guardrails, GUARD-*, docs/guardrails.md |
SEC-09 |
Signed releases, SBOM, SLSA provenance | ✅ CI runs attest-build-provenance, CI runs sbom-action |
SEC-10 |
Supply-chain check on spec dependencies | ✅ apiverity.security.dependencies, SEC-DEP-*, docs/supply-chain.md |
SEC-11 |
Abuse-surface & rate-limit audit | ✅ apiverity.security.abuse, SEC-RATE-LIMIT-* |
SEC-12 |
Auth-scope coverage reporting | ✅ apiverity.security.oauth_scopes, SEC-SCOPE-* |
SEC-13 |
Tamper-evident audit export | ✅ apiverity audit, docs/audit-export.md |
SEC-14 |
Kill-switch / emergency policy freeze | ✅ apiverity freeze, docs/kill-switch.md |
SEC-15 |
Air-gapped install + Helm chart | ✅ deploy/helm/apiverity/Chart.yaml, docs/air-gapped.md |
SEC-16 |
Container image with a CLI entrypoint | ✅ docker/entrypoint.sh, exec apiverity in docker/entrypoint.sh |
14 of 16.
| ID | Feature | Evidence |
|---|---|---|
DX-01 |
apiverity init guided onboarding | ✅ apiverity init, docs/onboarding.md |
DX-02 |
One-line install everywhere | ✅ install.sh, install.ps1, scripts/install.py, docs/install.md |
DX-03 |
Turn PyPI publishing on | ⏳ Registering a Trusted Publisher is a form on the PyPI account that owns the name. The workflow is wired and guarded by PUBLISH_ENABLED. |
DX-04 |
A real action.yml | ✅ action.yml, docs/ci.md |
DX-05 |
Config-as-code + published JSON Schema | ✅ apiverity config, schemas/config-v1.schema.json, scripts/generate_config_schema.py |
DX-06 |
Watch mode | ✅ apiverity watch |
DX-07 |
Language Server (LSP) | ✅ apiverity lsp, apiverity.lsp.server, docs/lsp.md |
DX-08 |
VS Code extension (thin LSP client) | ✅ editors/vscode/package.json, editors/vscode/src/extension.ts, CI runs editors/vscode |
DX-09 |
Browser playground (WASM/Pyodide) | ✅ docs/playground.md, docs/playground/app.js, scripts/generate_playground.py |
DX-10 |
--spec-format override | ✅ --spec-format |
DX-11 |
Global --json | ✅ tests/unit/test_json_output_coverage.py |
DX-12 |
Interop importers | ✅ apiverity import-rules, apiverity.rules.spectral, apiverity.traffic.postman, docs/spectral-migration.md |
DX-13 |
oasdiff-compatible export | ✅ apiverity.reports.oasdiff, docs/oasdiff-migration.md |
DX-14 |
Portable .apiverity bundle + verify | ✅ apiverity export, apiverity verify |
DX-15 |
Generated-SDK break detection | ✅ apiverity.diff.sdk_surface, SDK-*, --sdk on breaking, docs/sdk-surface.md |
DX-16 |
Zenodo DOI + CITATION.cff identifiers | ⏳ Minting a DOI needs the GitHub-Zenodo integration enabled on the account that owns the repository. CITATION.cff is checked in and ready for the identifier. |
12 of 12.
| ID | Feature | Evidence |
|---|---|---|
TEAM-01 |
Consumer registry & blast-radius mapping | ✅ apiverity.rules.consumers, --consumers on breaking, docs/blast-radius.md, web/src/pages/team.tsx |
TEAM-02 |
Contract ownership registry | ✅ CODEOWNERS in apiverity/reports/routing.py |
TEAM-03 |
PR bot with non-breaking alternatives | ✅ scripts/build_pr_comment.py, pull_request in action.yml |
TEAM-04 |
Monorepo / multi-service aggregation | ✅ apiverity sweep, docs/monorepo-sweep.md |
TEAM-05 |
Slack / Teams routing by ownership | ✅ apiverity notify, apiverity.reports.routing |
TEAM-06 |
Concrete OIDC provider | ✅ apiverity.server.oidc, docs/oidc.md |
TEAM-07 |
Merge-queue / required-check integration | ✅ CI runs merge_group, docs/merge-queue.md, tests/unit/test_required_checks.py |
TEAM-08 |
Cross-repo spec dependency graph | ✅ apiverity graph, apiverity.specs.graph, docs/dependency-graph.md |
TEAM-09 |
Scheduled governance reports | ✅ apiverity digest, apiverity.reports.digest, docs/digest.md |
TEAM-10 |
Migration guides attached to approvals | ✅ apiverity.rules.migration, docs/migration-guides.md |
TEAM-11 |
SLA/SLO attachment to operations | ✅ apiverity.performance.slo, SLO-*, docs/objectives.md |
TEAM-12 |
Multi-tenant org isolation hardening | ✅ org_id in apiverity/server/store.py, tests/unit/test_security_hardening.py |
18 of 18.
| ID | Feature | Evidence |
|---|---|---|
DASH-01 |
Design-token system | ✅ web/src/styles.css, --s1: in web/src/styles.css |
DASH-02 |
Live server connection | ✅ web/src/live.ts, web/src/components/SourcePicker.tsx |
DASH-03 |
Command palette (⌘K) | ✅ web/src/components/CommandPalette.tsx |
DASH-04 |
Real charting layer | ✅ Sparkline in web/src/components/ui.tsx |
DASH-05 |
Motion system | ✅ @keyframes in web/src/styles.css |
DASH-06 |
Skeleton/optimistic loading states | ✅ Skeleton in web/src/components/ui.tsx |
DASH-07 |
Full keyboard navigation + focus management | ✅ skip-link in web/src/styles.css |
DASH-08 |
WCAG 2.2 AA accessibility pass | ✅ skip to content in web/src/App.test.tsx |
DASH-09 |
Responsive 360px to ultrawide | ✅ @media in web/src/styles.css |
DASH-10 |
Side-by-side diff viewer | ✅ diff in web/src/pages/contract.tsx |
DASH-11 |
Blast-radius / dependency graph visualisation | ✅ web/src/pages/blast.test.tsx, blast in web/src/pages/team.tsx |
DASH-12 |
MCP fleet posture view | ✅ web/src/pages/agents.tsx |
DASH-13 |
Drift timeline / sparklines | ✅ Sparkline in web/src/components/ui.tsx |
DASH-14 |
Saved views, filters in URL, shareable deep links | ✅ web/src/views.ts, web/src/components/SavedViews.tsx, docs/saved-views.md |
DASH-15 |
Export to PDF / PNG / CSV | ✅ web/src/export.ts, svgToPng in web/src/export.ts |
DASH-16 |
Real-time run progress over SSE | ✅ web/src/sse.ts |
DASH-17 |
Onboarding tour + empty-state guidance | ✅ web/src/components/Tour.tsx, docs/onboarding.md |
DASH-18 |
Theme system: dark/light/system + high-contrast | ✅ prefers-contrast in web/src/styles.css |
10 of 14.
| ID | Feature | Evidence |
|---|---|---|
DIST-01 |
Terminal recording under the README headline | ✅ docs/demo.svg, docs/demo.cast, scripts/record_demo.py, CI runs record_demo.py --check |
DIST-02 |
Comparison table above the fold | ✅ How this compares in README.md, scripts/generate_competitive_table.py |
DIST-03 |
GitHub topics | ✅ .github/repo-metadata.yml, scripts/check_repo_metadata.py, CI runs check_repo_metadata.py --check |
DIST-04 |
Repo description + first paragraph carrying search keywords | ✅ description in .github/repo-metadata.yml, tests/unit/test_repo_metadata.py |
DIST-05 |
Awesome-list pull requests | ⏳ Pull requests against other people's repositories, from an account with a history. docs/awesome-list-submissions.md holds the prepared entries. |
DIST-06 |
Docs-site SEO: per-protocol and per-competitor landing pages | ✅ scripts/generate_landing_pages.py, docs/for/openapi.md, docs/vs/oasdiff.md, CI runs generate_landing_pages.py --check |
DIST-07 |
Upstream issue assistance using the ghost-route auditor | ⏳ Filing issues on other projects' trackers. The auditor that produces the evidence is apiverity ghosts. |
DIST-08 |
Opt-in anonymised dataset + report | ⏳ Starts with a consent decision this project should not make for a user: it collects nothing today, and the honest version needs a published schema and a way to see exactly what would be sent. |
DIST-09 |
Public reproducible benchmark, including losses | ✅ docs/benchmark.md, scripts/benchmark_oasdiff.py, this tool did not in docs/benchmark.md |
DIST-10 |
Example plugin + plugin authoring guide | ✅ examples/plugins/apiverity-house-rules/pyproject.toml, docs/plugin-authoring.md, tests/unit/test_example_plugin.py |
DIST-11 |
Quarterly competitor refresh, CI-enforced | ✅ .github/workflows/competitor-refresh.yml, tests/unit/test_competitor_freshness.py |
DIST-12 |
Conference/blog content pipeline from the dataset | ⏳ Draws on the dataset in DIST-08, which does not exist yet, and on a publishing cadence that is the maintainer's to set. |
DIST-13 |
llms.txt + machine-readable capability manifest | ✅ docs/llms.txt, docs/capabilities.json, scripts/generate_capability_manifest.py |
DIST-14 |
Cross-repo positioning line | ✅ tooltrace-bench in README.md |
These are finished on this side. Each needs a step that happens on somebody's account, not in this repository.
- DX-03 Turn PyPI publishing on — Registering a Trusted Publisher is a form on the PyPI account that owns the name. The workflow is wired and guarded by
PUBLISH_ENABLED. - DX-16 Zenodo DOI + CITATION.cff identifiers — Minting a DOI needs the GitHub-Zenodo integration enabled on the account that owns the repository.
CITATION.cffis checked in and ready for the identifier. - DIST-05 Awesome-list pull requests — Pull requests against other people's repositories, from an account with a history.
docs/awesome-list-submissions.mdholds the prepared entries. - DIST-07 Upstream issue assistance using the ghost-route auditor — Filing issues on other projects' trackers. The auditor that produces the evidence is
apiverity ghosts. - DIST-08 Opt-in anonymised dataset + report — Starts with a consent decision this project should not make for a user: it collects nothing today, and the honest version needs a published schema and a way to see exactly what would be sent.
- DIST-12 Conference/blog content pipeline from the dataset — Draws on the dataset in DIST-08, which does not exist yet, and on a publishing cadence that is the maintainer's to set.