ApyHub Built a System to Let AI Agents Run and Test APIs Directly from Code

·2 views

ApyHub, a utility API catalog, found itself maintaining two separate API descriptions after building an MCP server to let AI assistants like Claude and ChatGPT call its APIs directly. The team identified three distinct problems stemming from this duplication: agents lacking direct access to existing requests during debugging, manual MCP server creation causing API definitions to drift out of sync, and no reliable way to gate agent access based on test status. To address this, they developed a workflow using their open-source tool Voiden, which stores API requests as plain Markdown files and allows coding agents to list, run, and inspect real endpoints without manual re-description. They also introduced an opt-in model where existing tested requests are simply marked as tools, keeping secrets in the environment and exposing nothing by default. A key design choice ties tool availability to test results — if a test fails, the corresponding agent tool goes offline — a strict tradeoff the team acknowledges is still open for debate.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

F-Droid 2.0 Launches Days Before Google Enforces Android Sideloading Rules

F-Droid released version 2.0 on September 24, 2025, just six days before Google begins enforcing developer identity verification for app installations on certified Android devices starting September 30. The rebuilt client features a Kotlin and Jetpack Compose codebase, improved search, combinable filters, and default auto-updates, and underwent an independent security audit after over a year of development. Google's new rule requires all sideloaded apps on certified devices to be tied to a verified developer's signing key, with initial enforcement in Brazil, Indonesia, Singapore, and Thailand before a planned global rollout in 2027. The policy creates a structural challenge for F-Droid, which builds apps from source and signs roughly 85% of its catalog with its own key rather than the original developer's key. Reproducible builds are considered the clearest solution, as they would allow F-Droid to distribute developer-signed APKs, but coverage remains only partial today.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer builds 59 privacy-first browser tools in vanilla JS with zero dependencies

A developer has publicly launched Antigravity Tools, a collection of 59 free, browser-based utilities built entirely in vanilla JavaScript with no external dependencies, backend servers, or analytics. The project was motivated by privacy concerns with popular online tools, such as JWT decoders and regex testers, which can log user data on remote servers. All operations run locally in the user's browser using native APIs including Web Crypto, Canvas, Web Audio, and IndexedDB. The toolkit covers a wide range of developer needs, including JWT inspection, RSA key generation, JSON formatting, cURL conversion, regex testing, and AI prompt utilities. The tools are freely accessible at antigravitytools.app, with the developer sharing technical learnings from the build process.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why SaaS Businesses Should Re-Validate VAT Numbers at Every Subscription Renewal

A VAT ID verified at the time of purchase only confirms validity on that specific date, not on future invoice dates. Under EU VAT rules, each subscription renewal constitutes a new supply, meaning businesses must hold valid evidence of a customer's VAT status for each individual invoice. A customer's VAT registration can lapse, be suspended, or change between renewals without any notification to the supplier. Hooking into a billing provider's renewal event to re-check VAT IDs just before each invoice is generated helps close this compliance gap. While no EU regulation mandates a specific re-validation frequency, aligning checks with the billing cycle is a practical, low-cost approach recommended in consultation with a tax adviser.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Safety-Test an AI Agent's SAP Integration Before Going Live

Before connecting an AI agent to SAP via Model Context Protocol (MCP), security and access controls must be validated beyond simple connectivity checks. Developers are advised to test denied scenarios—such as out-of-scope data requests, expired sessions, and unauthorized operations—as formal acceptance criteria, not afterthoughts. Each test should change only one condition at a time and record the principal, target system, scope, and outcome to confirm that authorization decisions are enforced server-side, not just hidden from the interface. Write operations require additional scrutiny, including testing that post-approval changes invalidate prior approvals and that timeouts are reconciled against actual downstream outcomes. MCP authorization is explicitly noted as a complement to—not a replacement for—SAP's own roles and authorization objects.

0 comments Read more at DEV Community