M
MCP Directory CURATED DIRECTORY
911 MCP servers indexed
中文
← Back to directory
O

OpenAPI Proxy MCP Server

Community
Dynamically expose any OpenAPI-defined REST API as MCP tools.
How to install ↓ Compare GitHub source repository ↗
Category
Dev Tools #243 of 438
Stars
★ 157 Popular
Transport
stdio (local process) · Streamable HTTP
Runtime
Python
Credentials
Optional API key
License
MIT
Last commit
51FMRS · D

mcp-openapi-proxy is a practical generic proxy that dynamically converts OpenAPI-defined REST APIs into MCP tools, simplifying integration. It supports multiple authentication schemes and filtering options, with rich examples and verified client compatibility. However, tool lists are dynamic and cannot be enumerated upfront; some clients have limited prompts/resources support. Overall, it's a powerful tool for quickly connecting a wide range of REST APIs.

Strongest · Setup experience 13/20 Weakest · Security and permissions 7/20

Reliability
8/20
Security and permissions
7/20
Maintenance
10/20
Documentation
13/20
Setup experience
13/20
Why each score
Reliability 8/20
Only README evidence is available; no source, CI, or committed tests were supplied. The README claims live client verification and bug fixes across 0.2.x/0.3.x, so a happy path is plausible, but none of it can be confirmed statically. The documented JSON-RPC expected response also shows a copied sqlite serverInfo, which weakens confidence. Deducted for missing executable evidence; score capped below 12 per static calibration.
Security and permissions 7/20
The proxy is designed to send user-supplied API keys and extra headers to arbitrary hosts from an OpenAPI spec; it can expose destructive verbs (DELETE/POST/PUT) and supports disabling TLS verification (IGNORE_SSL_TOOLS). No confirmation, host allowlisting, secret-masking, or security-policy evidence is present. These risks are visible but scoping/confirmation controls are incomplete; no red-line violation (no real secrets in examples, no exfiltration code visible).
Maintenance 10/20
MIT license, not archived, 5 open issues, and README documents multiple releases and issue fixes; this suggests an active project. However, no commit history, release tags, dependency-update or security-response channel is verifiable from the supplied material, and README claims themselves are untrusted evidence. Scored as active but with governance/versioning evidence gaps.
Documentation 13/20
README is unusually comprehensive: install, env-var reference, mode descriptions, many real-world examples, client matrix, troubleshooting, and limitations. Deductions for concrete inaccuracies: expected initialize response names a sqlite server; GetZep auth note contradicts its config example; VirusTotal example uses EXTRA_HEADERS while the test command uses API_AUTH_HEADER/API_AUTH_TYPE. Also, much 'verification' content is self-reported without accessible test artifacts.
Setup experience 13/20
Setup path is clearly described: install/run via uvx, then add an mcpServers entry; per-client config snippets are provided for many mainstream CLIs. Complexity exists (many env vars, whitelist tuning), and no CI/test evidence is supplied, so per static calibration setup cannot exceed 15; the README claims of verified clients are not independently confirmable.

Static review · not runListed 2026-08-07

Read the FMRS scoring method →

Fit and risk

What it can accessUses the network

Best for

  • Developers and teams who want to integrate existing REST APIs described by OpenAPI into the MCP ecosystem.
  • Scenarios where you need quick conversion of APIs to MCP tools with dynamic tool generation.

Not for

  • APIs without OpenAPI specifications (would need manual generation or conversion).
  • Use cases requiring fine-grained control over each tool's behavior (this server is generic and spec-driven).
  • APIs with complex authentication flows (e.g., OAuth) unless handled manually via custom headers and EXTRA_HEADERS.

Required permissions

  • Access to the OpenAPI spec URL (HTTP or local file).
  • API keys or tokens for the target API (via API_KEY or custom headers).
  • Read/write permissions to the target API depending on exposed tools.

Risks and side effects

  • Exposing many tools may consume tokens or degrade performance; use TOOL_WHITELIST to limit.
  • Credentials are passed via environment variables; ensure secure configuration.
  • Remote spec downloads can be slow or fail, causing startup issues (mitigated by caching).
  • Some clients have incomplete prompts/resources support; features may be limited.

Setup

Before you start

Runtime：Python

OPENAPI_SPEC_URL required Required; URL or file:// path to the OpenAPI specification JSON/YAML.
API_KEY optionalsecret Auth token for the target API, sent as Bearer by default; get it from the API provider's dashboard.
Other optional settings (21)
OPENAPI_SIMPLE_MODE optional Set to true to enable FastMCP simple mode (static tool set).
TOOL_WHITELIST optional Comma-separated endpoint paths to expose as tools.
ADDITIONAL_RESOURCES optional Comma-separated name=/path/to/file entries served as extra MCP resources.
TOOL_NAME_PREFIX optional Prefix prepended to all tool names.
API_AUTH_TYPE optional Overrides the default Bearer scheme (e.g. Token, api-key).
STRIP_PARAM optional JMESPath expression to strip unwanted parameters from payloads (e.g. token for Slack).
DEBUG optional Set to true/1/yes for verbose debug logging.
EXTRA_HEADERS optional Extra outgoing HTTP headers; accepts a JSON array, one per line, or \n-separated entries.
SERVER_URL_OVERRIDE optional Overrides the base URL from the OpenAPI spec.
TOOL_NAME_MAX_LENGTH optional Maximum length for tool names before truncation.
IGNORE_SSL_SPEC optional Set to true to skip SSL verification when fetching the spec.
IGNORE_SSL_TOOLS optional Set to true to skip SSL verification for tool API requests.
API_AUTH_HEADER optional Header name used when API_AUTH_TYPE=api-key (e.g. x-apikey).
OPENAPI_SPEC_FORMAT optional Set to yaml to parse file:// specs as YAML.
OPENAPI_SPEC_CACHE_TTL_SECONDS optional Disk cache TTL in seconds for remote specs; default 86400, 0 disables.
ENABLE_TOOLS optional Feature gate for the tools surface in low-level mode; default enabled.
ENABLE_PROMPTS optional Feature gate for the prompts surface in low-level mode; default enabled.
ENABLE_RESOURCES optional Feature gate for the resources surface in low-level mode; default enabled.
CAPABILITIES_TOOLS optional Advertise listChanged on the tools capability; default false.
CAPABILITIES_PROMPTS optional Advertise listChanged on the prompts capability; default false.
CAPABILITIES_RESOURCES optional Advertise listChanged on the resources capability; default false.

Install from PyPI:\n\n``bash\nuvx mcp-openapi-proxy\n`\n\nConfigure within your MCP ecosystem's mcpServers settings:\n\n`json\n{\n "mcpServers": {\n "mcp-openapi-proxy": {\n "command": "uvx",\n "args": ["mcp-openapi-proxy"],\n "env": {\n "OPENAPI_SPEC_URL": "${OPENAPI_SPEC_URL}",\n "API_KEY": "${API_OPENAPI_KEY}"\n }\n }\n }\n}\n``\n\nSet the required OPENAPI_SPEC_URL environment variable and optional ones like API_KEY, TOOL_WHITELIST, etc.

claude_desktop_config.json 
{
  "mcpServers": {
    "mcp-openapi-proxy": {
      "command": "uvx",
      "args": [
        "mcp-openapi-proxy"
      ],
      "env": {
        "OPENAPI_SPEC_URL": "${OPENAPI_SPEC_URL}",
        "API_KEY": "${API_OPENAPI_KEY}"
      }
    }
  }
}

Shown for Claude Desktop. Other clients may use a different file or key (VS Code uses "servers") — the configurator below converts it.

.vscode/mcp.json
{
  "servers": {
    "mcp-openapi-proxy": {
      "command": "uvx",
      "args": [
        "mcp-openapi-proxy"
      ],
      "env": {
        "OPENAPI_SPEC_URL": "${OPENAPI_SPEC_URL}",
        "API_KEY": "${API_OPENAPI_KEY}"
      }
    }
  }
}

Goes in your project's .vscode/mcp.json (VS Code uses a "servers" key).

Terminal
claude mcp add mcp-openapi-proxy -e 'OPENAPI_SPEC_URL=${OPENAPI_SPEC_URL}' -e 'API_KEY=${API_OPENAPI_KEY}' -- uvx mcp-openapi-proxy

Run it in a terminal; replace any <…> placeholders with your own values first.

Generate and validate client config

Check that it works

Run `OPENAPI_SPEC_URL="https://glama.ai/api/mcp/openapi." uvx mcp-openapi-proxy`; tools dynamically generated from the spec (e.g. get_v1_attributes) should appear in your client's tool list, or a JSON-RPC tools/list call should return a non-empty list.

Troubleshooting

  1. Ensure OPENAPI_SPEC_URL is set to a valid OpenAPI JSON URL or local file path.
  2. Verify the OpenAPI document is standard-compliant.
  3. Check TOOL_WHITELIST matches desired endpoint paths (dot-separated paths need exact match).
  4. Confirm API_KEY and API_AUTH_TYPE are correct (e.g., for Fly.io use Api-Key).
  5. Set DEBUG=true for verbose logging to stderr.

Things to try

Once connected, you can ask your AI assistant things like:

  • List all tools available from this OpenAPI spec
  • Call get_v1_attributes against the Glama spec
  • Get the metrics from APIs.guru using get_metrics_
  • Check my Slack bot token with the auth.test tool

Use cases

Exposing internal or third-party REST APIs (e.g., Slack, Notion, Asana, NetBox) to MCP clients so they can be called via natural language.
Dynamically generating tools in MCP workflows without writing custom code.
Controlling exposed endpoints via whitelist for security and performance.

Supported clients

Claude DesktopPartial support
Codex
GeminiPartial support
QwenPartial support
KilocodePartial support
OpenCode
VibePartial support
LettaPartial support

Listed from the project's documentation, not tested by this site.

Overview

mcp-openapi-proxy is a Python package that implements a Model Context Protocol (MCP) server designed to dynamically expose REST APIs—defined by OpenAPI specifications—as MCP tools, facilitating seamless integration of OpenAPI-described APIs into MCP-based workflows. It offers two operational modes: Low-Level Mode (default) renders each valid endpoint as a tool; FastMCP Mode (simple mode) exposes a static set of tools (list_functions and call_function). It supports OpenAPI v3 (with potential v2 support), endpoint filtering via whitelist, flexible authentication (Bearer in Authorization header, custom schemes, api-key header), and payload token stripping via JMESPath. It also provides additional MCP resources (e.g., use-case documents) and prompts (summarize_spec, whimsical_blog).

Similar servers

Context7 80 · B

Upstash's official server providing up-to-date third-party library docs for AI coding assistants

★ 62.9k · Tools 2 Compare with this →
Compare with other MCP servers

Source revision 04334a0c8992 Data synced 2026-10-12 Read the FMRS scoring method