openapi2mcp

Free · No signup · Processed in memory

Turn your REST API into an MCP server.

Upload your OpenAPI spec — auth included, no code. Claude, Cursor, and any MCP client can call your service directly, with your keys never touching the model.

  • Auth is the feature, not an afterthought. securitySchemes are read from your spec and mapped to environment templates automatically.
  • Keys never touch the model. Credentials are injected by your MCP client at runtime — they live in .env, never in code.
  • Read-only by default. Only GET endpoints are exposed; write operations stay hidden until you explicitly allow them.

Works with Claude Desktop Claude Code Cursor Codex any MCP client

OpenAPI → MCP converter

OpenAPI 3 · Swagger 2.0 · JSON / YAML

Parsing happens in memory. Your spec is never stored or retained.

Your spec is the source of truth

No tool definitions to hand-write, no auth to rewire, no second interface to keep in sync. When the API changes, regenerate.

01

Upload your spec

Drop in an OpenAPI 3 or Swagger 2 document — JSON or simple YAML. It is processed in memory; nothing is stored anywhere.

02

Review what’s exposed

Every endpoint becomes an MCP tool with its parameters and description. Read-only mode is on by default; write operations stay hidden until you allow them.

03

Connect your client

Download the TypeScript project, paste the ready-made config into Claude Desktop or Cursor, and your API is a set of tools the model can call.

How to use with Claude, Cursor & Codex

Two minutes from zip file to working tools. The snippets below use the Petstore sample.

Claude Desktop

Config lives at ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows).

  1. Unzip the generated project and note its absolute path.
  2. Run npm install, then cp .env.example .env and add your key.
  3. Merge the JSON below into your config file.
  4. Fully quit and restart Claude Desktop; the server appears under available tools.
{
  "mcpServers": {
    "petstore": {
      "command": "npm",
      "args": [
        "--prefix",
        "/absolute/path/to/openapi2mcp-petstore",
        "start"
      ]
    }
  }
}

Cursor

Config lives at ~/.cursor/mcp.json. The shape is the same mcpServers map.

  1. Unzip the project and run npm install inside it.
  2. Create ~/.cursor/mcp.json with the JSON below.
  3. Replace the path with your project’s absolute path and add your key.
  4. Open Cursor’s agent panel — your endpoints are now callable tools.
{
  "mcpServers": {
    "petstore": {
      "command": "npm",
      "args": [
        "--prefix",
        "/absolute/path/to/openapi2mcp-petstore",
        "start"
      ]
    }
  }
}

Claude Code

One command registers the server at user scope — available in every project, no config file editing.

  1. Unzip the generated project and note its absolute path.
  2. Run npm install, then cp .env.example .env and add your key.
  3. Run the command below with your real path.
  4. Restart Claude Code — the endpoints appear as tools.
claude mcp add petstore -s user -- npm --prefix /absolute/path/to/openapi2mcp-petstore start

Codex

Register with one command, or edit ~/.codex/config.toml directly.

  1. Unzip the generated project and note its absolute path.
  2. Run npm install, then cp .env.example .env and add your key.
  3. Run the command below with your real path.
  4. Start Codex — the endpoints appear as tools.
codex mcp add petstore -- npm --prefix /absolute/path/to/openapi2mcp-petstore start

Security isn’t a feature. It’s the architecture.

MCP replaces “the AI logs in like a human” with something simpler: you configure credentials once, the model only initiates calls, and keys never pass through the model.

“Your token never touches our database.”The hosting promise — credentials are injected by your MCP client and exist only in runtime memory.

Client-injected credentials

You add tokens in the Claude/Cursor MCP config. They travel as environment variables straight into the server process — the platform never stores them.

Memory-only at runtime

Tokens live in process memory for the duration of a call. No database row, no disk write, no backup to leak.

Scrubbed logs

Authorization and API-key headers are stripped before anything reaches logs or error monitoring.

Read-only by default

Only GET endpoints are exposed unless you whitelist write operations — and those still require human confirmation inside the MCP client.

Audit trail

See exactly which endpoints the AI called, and when. Response bodies are never recorded.

Abuse limits

Rate limiting and anomalous-call detection blunt the damage a prompt-injected burst of dangerous calls could do.

Honest limits — what we don’t claim

  • On the hosted tier, tokens do pass through the server process at runtime. Zero storage and log scrubbing mitigate this; it is not magic.
  • Request and response bodies flow through the hosting layer. High-sensitivity teams should use one-click Deploy-to-Vercel or self-host instead.
  • Prompt injection is an AI-side risk that authentication cannot solve. Read-only defaults plus human confirmation are the backstop.
  • Your API’s spec can misstate its own auth. Directus documents an apiKey header but only accepts Bearer tokens — if calls come back 401, set the full value (Bearer your-token) in the generated .env.
  • Permission-scoped specs list only the endpoints your token can see, so your tool count can come out lower than the API’s public docs.