Fetching from the wire…
Markets2026-09-14 · source-backed
Its comparison page puts it as "Postman is where you test a request. Elva is where your API lives." It reads repository code to generate OpenAPI specs, rescans on every commit instead of relying on hand-maintained collections, grades endpoints on design, DX, AI readiness, security and performance, and blocks publishing on breaking changes. The pricing is the sharper attack: flat per-workspace with unlimited members and endpoints against Postman's per-seat model.
Each link below shares sources, entities, or timing with this story.
Berlin-based Routebase posted to Show HN August 26 with one OpenAPI spec driving a visual editor, generated mock servers, test suites, security scans, a docs portal, drift and breaking-change monitoring, and a built-in MCP server so agents work the spec like a teammate. Pricin...
This is the most immediately useful pattern I've seen this month. Cloudflare shipped Code Mode MCP, and the numbers are hard to argue with. Their API has 2,500+ endpoints. Exposing each one as a separate MCP tool would consume 1.17 million tokens of context just for tool defin...
Cloudflare shipped Code Mode MCP this week, and the numbers are hard to ignore. They replaced per-endpoint tool definitions with exactly two tools: search() and execute(). That's it. The result? Their own API surface, all 2,500+ endpoints, went from 1.17 million tokens of tool...
The repo is MIT with 64 stars, last pushed the morning of September 12. It reads OpenAPI, AsyncAPI, GraphQL, gRPC and OpenRPC plus custom Markdown from a single project config and emits typed SDKs in multiple languages, interactive docs, and an MCP server handing agents typed...
GitWarren reviews the dirty worktree before anything is committed and ships 17 MCP tools so the agent answers questions inside its own review. Ponytail applies a stop rule before generation. Twinrun runs old and new versions of changed callables on identical inputs and diffs t...
GHSA-8cp3-qxj6-px34 covers utcp-http <= 1.1.3, where OpenApiConverter._extract_auth() reads the OAuth2 tokenUrl straight out of a remote spec and never validates it. The ensure_secure_url() guard the library applies to discovery URLs and tool invocation URLs is simply absent o...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.