OpenAPI MCP Server
The MCP server turns OpenAPI operations into agent tools and sends real requests to the configured REST API.
- 302 ★ on the repository
- Last commit
- MIT
Extended access
Why this level
- The agent executes API operations with supplied rights, including data changes when those tools are exposed.
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add mcp/openapi-mcp-serverDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- The agent executes API operations with supplied rights, including data changes when those tools are exposed.
This is third-party code. Review the repository files before installing.
What it does
OpenAPI MCP Server by ivo-toby reads an API specification and exposes its operations as agent tools. Users configure the service address, specification source and authentication headers. The agent discovers available actions and calls them with parameters. Specs may be local files or URLs. The server supports local and HTTP connections, tool selection and optional prompts and resources for compatible clients.
Who it is for. Internal REST API developers connecting an existing OpenAPI specification to Claude Desktop or Cursor.
Good fit when
- Your service has an OpenAPI description and you want to expose its operations to an agent.
- For a test API, you want to try one call from chat.
- From a large specification, you need to expose only selected operations.
- Across deployments, you want to use either a local file or hosted specification.
Not a fit when
- You only need documentation without request execution.
- The specification exposes more actions than the model should receive.
- The service lacks a usable description of its operations.
Example request
Connect the test OpenAPI spec for listing records only and show exposed tools before the first request.MCP
- Transport
- stdio
- Authentication
- not required
Limitations
The server calls the real API, so write operations can change production data within token permissions. All operations load by default; restrict the toolset and account rights before connecting. The specification must match the current service, as stale schemas can produce failures or incorrect parameters. Authentication headers live in process configuration; protect it and keep it out of chats and repositories.
How to disable. Remove MCP access, stop the server and revoke the target API token. Review completed operations and data changes in the service itself.
FAQ
Must I clone the repository?
No. The client can run the published npm package with npx.
Where do I select the specification?
Use `OPENAPI_SPEC_PATH` with a file path or URL.
How do I hide unwanted operations?
Configure tool filters and loading mode; the default exposes all operations.
Why are prepared prompts missing in the client?
Check client support for server prompts and whether the prompt file is configured.
Can I use client certificates for an internal API?
Yes. Configuration supports client certificates, keys and trusted CAs for mutual TLS.
Discussion
No questions or reviews yet.
Related
MCP serversOpenMCP turns any OpenAPI specification into an MCP server and lets you choose which tools the agent sees
A CLI that builds a ready-made TypeScript MCP server from an OpenAPI 3 spec, with tools, validation and auth generated for you
A gateway that turns any API with an OpenAPI V3 spec into an MCP server, without touching the original API
An MCP server that lets an agent read files, search code and run commands in a workspace
The openmcp CLI and a VS Code extension for debugging MCP servers: tools, prompts and resources, chat with a model, test cases
A plugin with skills for building TypeScript MCP servers and MCP apps: the agent scaffolds, edits, debugs and verifies them
README in short
HTTP mode binds to 127.0.0.1 by default. Tool naming includes handling for long operation names.