The collection overview
Open any collection and you land on a command center, not a file listing: who consumes this API, how it is secured, what changed recently, who owns the code, and how close it is to agent-ready. Every panel is computed from your source and your git history — none of it is hand-maintained, and all of it refreshes on the next scan.
A header that already knows your API
Before you scroll, the top of the page has introduced the collection better than most READMEs:
- The name and an auto-written summary of what the endpoints actually do (for a Billing collection: “reads, deletes, creates external-customer, checkout-session, check-subscription, auth”).
- The owner — the engineer with the most commits to this collection’s source files, not whoever created the page.
- Two badges pinning exactly what you are looking at: the commit the collection was built from and the OpenAPI version of its spec.
Three signals, front and center
Three cards sit above the fold because they answer the three questions every API owner gets asked.
Who's consuming
How many frontend pages and components call this API — and how many endpoints nothing calls at all.
Security Posture
Auth coverage, endpoints with no auth defined, and whether HTTPS is enforced.
MCP Server
Expose this collection's operations as agent-callable tools, one click from the overview.
Who’s consuming comes from Elva’s cross-reference pass over your own source: it counts the frontend pages and components that reach this API through its request wrappers, and flags unused endpoints that nothing references. This is consumption data most teams simply do not have — and it is the difference between “can I change this?” being a guess or a lookup.
Security Posture reads the contract the way an attacker would: what share of endpoints declare auth (auth coverage), how many define no auth at all, and whether HTTPS is enforced. A collection showing 0% auth coverage across 16 endpoints is not a style issue — it is a finding, surfaced before any agent or attacker finds it for you.
MCP Server closes the loop: the same collection you are auditing becomes a hosted MCP server without leaving the page, so “agent-ready” is a button, not a project.
Read the first two cards together. An endpoint that is both unused and unauthenticated is pure attack surface — nobody depends on it, and nothing protects it. The overview puts both signals on the same screen so those endpoints have nowhere to hide.
Recent changes, mapped to endpoints
The overview’s change feed is not a wall of commit messages. Elva reconstructs it from git history and maps each commit to the exact endpoints it touched, so an entry reads like an API changelog: the commit message, a method-and-path badge such as
POST /stripe-webhook
, and when it happened. Release commits, version bumps, and bot noise are filtered out before anything reaches the feed.
That means “what changed in Billing last month?” is answered by scrolling, not by git log archaeology across a monorepo.
The details rail
Down the side, the rail compresses the collection’s health into numbers you can act on:
Signal | What it tells you |
Score & grade | The 0–100 quality score and A–F grade from the review engine — a 35/100 (F) is a to-do list, not a judgment |
Tags | The domain labels this collection carries in the catalog |
Repository | A direct link to the source repo the collection was scanned from |
Errors & warnings | Open findings from the quality checks, so zero means zero |
Source coverage | How many endpoints are backed by a real source file versus spec-only — "16 with source, 0 without" is full traceability |
Last scanned | How fresh everything on this page is |
Ownership you can act on
The bottom of the rail answers the 2 a.m. question — who do I ping?
- Last commit: author, avatar, message, and a link straight to the commit on GitHub.
- Recent contributors: everyone who has touched this collection’s source files recently, identity-matched across git logins, names, and emails so one person does not appear three times.
- The owner at the top is computed the same way — most commits to the collection’s files, with release and bot commits excluded — so credit lands on the engineer who wrote the code, not the one who cut the release.
This page is what "living catalog" means in practice: consumption, security, changes, and ownership recomputed on every scan. Documentation that maintains itself is documentation that stays true.
Where to go next
On this page
- The collection overview