The Powerduck Blog
Product updates, engineering notes, and guides for designing, debugging, testing, mocking, and serving MCP tools from one OpenAPI spec.
Browse the guidesHand-writing OpenAPI drifts, regex mistakes cache.get() for a route, and asking an LLM to summarize a repo hallucinates endpoints. Here is the deterministic way to scan real codebases into OpenAPI 3.2: prove the contract, flag every gap, and let AI fill only what it cannot invent.
Read articleYour favorite saved request probably exercises the easiest path. Change one input at a time to find the assumptions hiding behind a green Send button.
Read articleA demo shows that the new path works. A contract diff shows what existing callers now have to survive. Here is a focused way to review an API change without turning it into a committee meeting.
Read articleA working request is a great starting point. Before handing it to another developer, answer the questions a cURL command cannot: what is required, what can vary, and what happens when it fails?
Read articleAn AI-generated schema can be valid, detailed, and wrong. A delegated handler shows why more context is not enough—and what an evidence-based review should check.
Read articleHiding a loading state does not stop work. Follow cancellation from the browser through queued requests and upstream services, then test the races users actually hit.
Read articleA green status code can hide a broken integration. Here are five checks that reveal what your happy-path request misses, with a small contract test you can run today.
Read articleA spec used only to render docs cannot stop a malformed request from reaching your handlers. Runtime validation middleware uses the same OpenAPI document to check incoming requests and outgoing responses, returning consistent 400s with field-level errors. Here is how request and response...
Read articleAgent work is long: research, multi-step tool calls, code generation. Blocking on one JSON response hides progress and hits timeouts. The Agent2Agent protocol models a task with explicit states, streams status and artifact updates over Server-Sent Events, and can deliver completion as a push...
Read articleThe security array means OR, any one listed scheme is enough; combining schemes inside one requirement object means AND, all are required. Get this backwards and an endpoint that needs both an API key and a bearer token accepts just one, or a public endpoint demands credentials. Here is how to...
Read articleLiveness and readiness are different questions: is the process running, and can it serve traffic right now including its dependencies? Collapse them into one /health endpoint and Kubernetes kills a pod briefly waiting on its database, or routes traffic to a half-warmed instance. Here is the...
Read articleOne OpenAPI document can render five very different doc experiences. We put a realistic OpenAPI 3.1 spec with webhooks, callbacks, polymorphic schemas, and security schemes through Swagger UI, Redoc, Scalar, Stoplight Elements, and RapiDoc, and compared try-it requests, code samples, advanced...
Read article