Name: Loutre
Author: loutre

Loutre MCP

Hosted mock APIs from OpenAPI, TypeScript or Postman: realistic data, errors and latency on demand.

Tool-list grade A Remote · Streamable HTTP No auth needed 17 tools v1.0.0

No reviews yet by loutre The publisher’s own endpoint — this marketplace is not in the path

93/100

tool-list score

tools declared

remote

at its publisher

—

calls last 7d

What it does

Hosted mock APIs from OpenAPI, TypeScript or Postman: realistic data, errors and latency on demand.

Quickstart

# 1 — add it to Claude Code
claude mcp add --scope user --transport http loutre-mcp https://api.loutre.app/mcp

# 2 — ask your agent for something these tools do
#   create_mock, list_mocks, get_mock and 14 more

Loutre costs nothing on mcprush: there is no plan to choose here, no cap to set and nothing mcprush can bill you for.

Publishernot claimed

loutre1 server

1 category

All 1 server

Collected from a public index. Nobody has claimed this account, so nothing here was written by its author — claim it if it is yours.

Tool surface

What the model actually sees. Descriptions are diffed on every release — see version history.

Only tools that write or reach the network

Create a hosted mock from an OpenAPI 3.0/3.1 or Swagger 2.0 document (YAML or JSON), from TypeScript types (interfaces, types, enums: CRUD routes derived, or a route map type keyed like "GET /users") or from a Postman v2 collection, an Insomnia export (v4 JSON or v5 YAML), a Bruno collection (JSON export, or .bru files one after the other), a HAR file (headers and cookies are dropped, data is gene

Parameter	Type	Required	Notes
spec	string	no	The full document, verbatim: OpenAPI, Swagger, TypeScript types, a Postman, Insomnia or Bruno collection, a HAR file, a db.json or curl commands
url	string	no	Public URL of the document, instead of spec
auto	boolean	no	With url: re-read every six hours (default true)
seed	string	no	Data seed, for reproducible data sets
locale	string	no	Language of names, addresses, texts and error messages (default: the request's language, else English)
slug	string	no	Desired subdomain (Pro plan)

List the connected account's mocks (API token required), with their URL, routes and expiry.

No parameter schema on file.

Details of a mock: routes with identifiers, behaviour, lock, sample generated bodies per route.

Parameter	Type	Required	Notes
slug	string	yes	Subdomain of the mock, e.g. "brisk-otter"
ownerToken	string	no	Owner token received at creation (not needed when the account is connected with an API token)

Call a route of the mock like an HTTP client would and return the status, the x-loutre-* headers and the body. The headers x-loutre-status, x-loutre-delay, x-loutre-count, x-loutre-message and x-loutre-seed are honoured; latency is not awaited, it is reported in delayMs. Writes (POST, PUT, PATCH, DELETE) are persisted when persistent state is on. For a GraphQL mock, POST to its GraphQL path with t

Parameter	Type	Required	Notes
slug	string	yes	Subdomain of the mock, e.g. "brisk-otter"
method	string	yes	—
path	string	yes	Path with its query string: "/users/42?expand=orders"
headers	object	no	Request headers, including x-loutre-*
body		no	JSON body for POST, PUT, PATCH
accessKey	string	no	Access key (lk_…) of a private mock you do not own
ownerToken	string	no	Owner token received at creation (not needed when the account is connected with an API token)

Change a mock's behaviour: default status, latency, jitter, error rate, persistent writes, and per route status, latency, hand-written bodies, rules. Merge semantics: missing keys are kept, null clears.

Parameter	Type	Required	Notes
slug	string	yes	Subdomain of the mock, e.g. "brisk-otter"
patch	object	yes	Same fields as PATCH /mocks/:slug/behavior: a missing key is kept, null clears
ownerToken	string	no	Owner token received at creation (not needed when the account is connected with an API token)

Set the JSON body a route returns for a given status (hand-written response); a null body restores the generated response.

Parameter	Type	Required	Notes
slug	string	yes	Subdomain of the mock, e.g. "brisk-otter"
route	string	yes	Route identifier, lowercase method: "get:/users/{id}"
status	integer	yes	—
body		yes	JSON body, or null to go back to the generated response
ownerToken	string	no	Owner token received at creation (not needed when the account is connected with an API token)

Add a conditional response to a route: when the request matches the conditions (query, header, path param, body field), the mock answers with this status, body and latency. Rules are evaluated in order, the first match wins; x-loutre-* headers keep priority.

Parameter	Type	Required	Notes
slug	string	yes	Subdomain of the mock, e.g. "brisk-otter"
route	string	yes	Route identifier, lowercase method: "get:/users/{id}"
when	object	yes	Every condition must hold
status	integer	no	—
body		no	JSON body of the response
latencyMs	number	no	—
name	string	no	Human-readable label of the rule
ownerToken	string	no	Owner token received at creation (not needed when the account is connected with an API token)

Remove every conditional rule of a route.

Parameter	Type	Required	Notes
slug	string	yes	Subdomain of the mock, e.g. "brisk-otter"
route	string	yes	Route identifier, lowercase method: "get:/users/{id}"
ownerToken	string	no	Owner token received at creation (not needed when the account is connected with an API token)

Generate a new data set (new seed), for the whole mock or for one route and the routes sharing its collection. A full new set forgets persisted writes.

Parameter	Type	Required	Notes
slug	string	yes	Subdomain of the mock, e.g. "brisk-otter"
seed	string	no	—
routeId	string	no	Route identifier, lowercase method: "get:/users/{id}"
locale	string	no	Switch the data language (whole mock only)
ownerToken	string	no	Owner token received at creation (not needed when the account is connected with an API token)

The latest requests received by the mock, most recent first: method, path, query, status, headers and body as received (body cut at 8 KB), where the answer came from, latency. Each entry has an id for replay_request.

Parameter	Type	Required	Notes
slug	string	yes	Subdomain of the mock, e.g. "brisk-otter"
limit	integer	no	—
ownerToken	string	no	Owner token received at creation (not needed when the account is connected with an API token)

Replay a request from the log exactly as it was received (same method, path, headers and body) against the mock as it is now, and return the answer. Useful after changing a rule, a body or a scenario.

Parameter	Type	Required	Notes
slug	string	yes	Subdomain of the mock, e.g. "brisk-otter"
id	string	yes	Entry id from get_requests
ownerToken	string	no	Owner token received at creation (not needed when the account is connected with an API token)

Empty the mock's request log.

Parameter	Type	Required	Notes
slug	string	yes	Subdomain of the mock, e.g. "brisk-otter"
ownerToken	string	no	Owner token received at creation (not needed when the account is connected with an API token)

Re-read the schema at the mock's source URL now and update the mock if it changed (routes, fields; settings kept, persisted writes forgotten). force regenerates even when the document is unchanged.

Parameter	Type	Required	Notes
slug	string	yes	Subdomain of the mock, e.g. "brisk-otter"
force	boolean	no	—
ownerToken	string	no	Owner token received at creation (not needed when the account is connected with an API token)

Serve the mock under the account's own hostname (Pro): declares it at Cloudflare and returns the CNAME to create (hostname → target) plus the current status; call again without hostname to re-check, or with hostname null to remove it.

Parameter	Type	Required	Notes
slug	string	yes	Subdomain of the mock, e.g. "brisk-otter"
hostname		no	e.g. mock.acme.com; null removes; omitted re-checks the status
ownerToken	string	no	Owner token received at creation (not needed when the account is connected with an API token)

Forget persisted writes (POST, PUT, PATCH, DELETE): the generated collections come back as they were.

Parameter	Type	Required	Notes
slug	string	yes	Subdomain of the mock, e.g. "brisk-otter"
ownerToken	string	no	Owner token received at creation (not needed when the account is connected with an API token)

Lock a mock with a token (private) and/or restrict the allowed browser origins. Pro plan.

Parameter	Type	Required	Notes
slug	string	yes	Subdomain of the mock, e.g. "brisk-otter"
private	boolean	no	—
origins		no	Allowed origins (https://app.example.com); null to allow all
ownerToken	string	no	Owner token received at creation (not needed when the account is connected with an API token)

Permanently delete a mock and its kept schema.

Parameter	Type	Required	Notes
slug	string	yes	Subdomain of the mock, e.g. "brisk-otter"
ownerToken	string	no	Owner token received at creation (not needed when the account is connected with an API token)

Free

$0 forever

Every tool — any call limit is its publisher’s, not ours
No card, and mcprush charges nothing for it
Runs at its publisher’s own address — this marketplace is not in the path
Nothing to cap, because mcprush bills nothing

Nothing here is billable: mcprush charges nothing to install Loutre or to call it, at any volume.

ATool-list grade · score 93 / 100

Release 1.0.0 · scanned 3 Nov 2026

Graded from the tools this server lists, not from its source code.

Two independent axes, because powerful and malicious are different questions. The grade is threat only. The capability level is blast radius, and it is never a penalty on the grade — it is priced as one subtract-only term in the score, where you can see it.

Threat score100

Client score93

Findings0 threat · 1 capability

Capabilitymoderate

Coveragemanifest

Verificationnot in this report

Surface digest2bfb6d7a5c0de70adcc4d642317ffdb563e0f7b8c978df3016820068c2ec4c67

Score vectorthreat 100 → client 93

Term	Level	What it prices	Points
capability-exposure	moderate	capability blast radius (moderate) — client exposure if the model is manipulated	−3
coverage-honesty	manifest	inspection depth (manifest) — how much of the target the scan could see	−4

score = clamp(round(threatScore − E_cap − E_ver − E_cov), 0, 100). No model, no opinion, no network call at scoring time: the same methodology version against the same bytes always produces this number, and every line above is a field of the report rather than a summary of it.

What the scan could actually read

A grade is only as meaningful as its coverage, so the scanner publishes its own depth before it publishes its result.

The scan read each tool’s name, description, input schema and annotations exactly as the server listed them the last time it answered us; no code was reviewed. We ask the server again about once a month, and a list that changed is graded again.

Tool surfaceread

Implementation sourcenot available

Package metadatanot available

Live transportnot available

The implementation source was not read — this reflects the declared tool metadata only.

Capability — what it could do if the model were manipulated

Tags derived from each tool’s schema and the implementation, not from what the tool calls itself. moderate is the level these add up to.

Tool	Capability tags	Why the tag was assigned
create_mock	external-sink	external-sink: keyword "curl"
list_mocks	no tags
get_mock	no tags
call_mock	no tags
set_behavior	no tags
set_response	no tags
add_rule	no tags
clear_rules	no tags
regenerate_mock	no tags
get_requests	no tags
replay_request	no tags
clear_requests	no tags
sync_mock	no tags
set_domain	no tags
reset_state	no tags
set_access	no tags
delete_mock	no tags

Toxic-flow graph

The lethal trifecta, checked as a graph rather than as a checklist: untrusted input, a sensitive source and an external sink have to meet before there is a path worth worrying about.

The public result for this release does not print the flow graph, so there is nothing to show here. That is not the same as "no paths were found": what the scan did read is above, under coverage.

Supply chain and provenance

Integrityfirst-seen

Surface digest2bfb6d7a5c0de70a

Scanned2026-11-03

This is the first scan of this surface here, so there is nothing yet to compare it against.

Every result on this tab comes from one deterministic pass over the published package — offline, rule by rule, and auditable line by line above. Same methodology version, same bytes, same score.

Where are you running it?

Tool surface

Release history

Loutre MCP

What it does

Quickstart

Where are you running it?

Tool surface

What counts against your monthly calls

What the scan could actually read

Capability — what it could do if the model were manipulated

Toxic-flow graph

Supply chain and provenance

Release history

See also