API Evangelist enhancements overlay for CraftedTrust API

overlay: 1.0.0
info:
  title: API Evangelist enhancements overlay for CraftedTrust API
  version: 1.0.0
extends: ../openapi/_original/craftedtrust-com-openapi.yml
x-generated: '2026-11-04'
x-method: generated
x-source: >-
  openapi/craftedtrust-com-openapi.yml (verbatim copy of https://craftedtrust.com/api/v1/openapi.yaml);
  https://craftedtrust.com/api-docs/; rate-limits/craftedtrust-com-rate-limits.yml;
  conventions/craftedtrust-com-conventions.yml; mcp/craftedtrust-com-tool-crosswalk.yml
x-rationale: >-
  The provider spec lists only https://mcp.craftedtrust.com as its server while the docs page documents the
  endpoints under https://craftedtrust.com/api/v1 (where the profile observed live 200s); it declares no
  security (the API is public), documents no rate-limit headers although X-RateLimit-Limit/Remaining were
  observed, and does not link its operations to the MCP tools that front them. This overlay records those
  facts without mutating the original.
actions:
  - target: $.servers
    description: Add the host the API docs page documents the endpoints on.
    update:
      - url: https://craftedtrust.com
        description: Host documented on https://craftedtrust.com/api-docs/ (paths under /api/v1); observed 200 on GET /api/v1/search, 2026-11-04.
  - target: $.info
    description: Record that the API is anonymous and point to the MCP server and rate-limit observation.
    update:
      x-apievangelist-auth: none (no securitySchemes; docs describe public endpoints; unauthenticated GET /api/v1/search returned 200 on 2026-11-04)
      x-apievangelist-mcp-endpoint: https://craftedtrust.com/api/v1/mcp
      x-apievangelist-rate-limit-observed: >-
        X-RateLimit-Limit 60 and X-RateLimit-Remaining 59 on an anonymous GET /api/v1/search (2026-11-04);
        window not documented.
  - target: $.paths['/api/v1/scan'].post
    description: Note idempotency and MCP binding for the only write operation.
    update:
      x-idempotent: false
      x-apievangelist-note: No Idempotency-Key or replay protection is documented; repeat calls start new scans and may hit 429.
      x-mcp-tool: scan_server
  - target: $.paths['/api/v1/search'].get
    description: Bind to MCP tool.
    update:
      x-mcp-tool: search_registry
  - target: $.paths['/api/v1/server/{url}'].get
    description: Bind to MCP tool.
    update:
      x-mcp-tool: check_trust
  - target: $.paths['/api/v1/stats'].get
    description: Bind to MCP tool.
    update:
      x-mcp-tool: get_stats