OpenAPI to MCP Server Generator

Point it at any OpenAPI 3.0/3.1 or Swagger 2.0 spec (file or URL) and your API becomes MCP tools in Claude Code, Claude Desktop, Cursor or any MCP client: one tool per operation, with typed arguments, the right read/write hints, and credentials taken from environment variables. No code to write, no SDK, no Node.

python3 server.py inspect https://api.example.com/openapi.json            # preview the tools, no calls made
python3 server.py serve   spec.yaml --read-only --tag invoices             # run it as an MCP server
python3 server.py generate spec.yaml --out ./acme-mcp --name acme          # standalone server folder / Claude Code plugin

• Reads real-world specs: JSON or YAML, OpenAPI 3.0 and 3.1, Swagger 2.0 (converted), local $refs (including shared path parameters and recursive schemas), allOf merging, nullable, readOnly fields dropped from inputs, server URL variables, deprecated operations skipped.
• Good tools: names from operationId (snake_case, max 64 chars, deduplicated) or method + path; descriptions from summary + description + [METHOD /path]; path, query, header and cookie parameters plus JSON body fields flattened into one input schema; form bodies supported.
• Safety hints: GET is readOnlyHint; DELETE/PUT/PATCH are destructiveHint, so clients can ask before running them. --read-only serves GET operations only. Path parameters are URL-encoded (no ../ tricks), and calls go only to the base URL.
• Filters: --tag, --exclude-tag, --include 'list*', --exclude 'delete*', --method. Warns above 40 tools.
• Auth from env: OPENAPI_MCP_BEARER (bearer and OAuth2 tokens), OPENAPI_MCP_API_KEY (header, query or cookie, as the spec says), OPENAPI_MCP_BASIC=user:pass, OPENAPI_MCP_AUTH_<SCHEME> per scheme, and --header 'X-Org: ${ORG_ID}'. api_info shows which operations lack credentials.
• Readable results: status, useful headers (Location, Retry-After, rate limits), JSON or text, capped at 20,000 chars. HTTP errors come back as tool errors with a hint (401 check credentials, 429 wait...).
• MCP 2026-07-28 and the 2025-11-25 handshake on the same server. Python 3.9+ standard library only.
• Claude Code plugin with the openapi-mcp skill (narrow the tools, keep keys out of chat, confirm before writes).

Claude Code: claude mcp add my-api -e OPENAPI_MCP_BEARER=... -- python3 /path/to/openapi-to-mcp/server.py serve https://api.example.com/openapi.json --read-only or set OPENAPI_MCP_SPEC and the credential env vars and run claude --plugin-dir /path/to/openapi-to-mcp.

Claude Desktop / Cursor: see examples/configs/.

./demo.sh starts a fictional task-tracker API on localhost, shows the 8 tools generated from examples/tasks-api.yaml (OpenAPI 3.1 with $ref, allOf, bearer and API-key auth), then lists, creates, updates and searches tasks through a real MCP session. examples/petstore-swagger2.json shows Swagger 2.0. ./run_tests.sh runs 13 tests, including the generated standalone server answering over stdio.

• External $refs (other files or URLs) aren't followed; bundle the spec first (e.g. redocly bundle).
• OAuth2 flows aren't run for you: paste a token into OPENAPI_MCP_BEARER. Multipart file uploads, XML bodies and callbacks/webhooks aren't supported.
• A tool is only as good as the spec: missing summaries or vague parameter names make worse tools. Fix the spec or narrow with filters.
• Not affiliated with the OpenAPI Initiative or Anthropic.

Related: MCP Server Builder Bundle: https://youraitools.co/marketplace/mcp-server-builder-bundle. MCP Config Validator: https://youraitools.co/marketplace/mcp-config-validator