Turn any OpenAPI specification into a smaller, LLM-friendly MCP server. Enables interaction with REST APIs through MCP tools using profiles to reduce complexity.
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.
Install from
M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.
process.env. You'll be asked to provide them before it can run.ENTERPRISE_ALLOWED_ALGSENTERPRISE_AUDIENCEENTERPRISE_CATEGORIESENTERPRISE_CLAIM_MAPPINGSENTERPRISE_DEFAULT_SCOPESENTERPRISE_ISSUERENTERPRISE_MODEGITLAB_TOKEN— Profile auth env vars: Use profile-specific names for value_from_env (for example, , YOUTRACK_TOKEN) instead of the generic MCP4_API_TOKEN.IMPLEMENTOR_COMMANDIMPLEMENTOR_FALLBACK_COMMANDIMPLEMENTOR_LEASE_TTL_MINUTESIMPLEMENTOR_TASK_JSONMCP4_ALLOWED_ORIGINS— Comma-separated origins (supports exact, wildcard .domain.com, CIDR 192.168.1.0/24)MCP4_ALLOWED_UNREGISTERED_REDIRECT_URIS— Comma-separated approved redirect URI rules for unregistered OAuth clients, e.g. http://localhost,cursor:// (optional)MCP4_ALLOW_PROFILES— Comma-separated profile ids/names/aliases allowed for routed profiles.MCP4_ALLOW_PROFILES_REGEX— Regex for allowed profile ids/names/aliases (applies only when routing is enabled).MCP4_ALLOW_UNREGISTERED_CLIENTS— Allow authorize requests for unregistered OAuth clients when redirect URIs match the approved allowlist (optional, default: false)MCP4_API_BASE_URL— Override OpenAPI server URLMCP4_API_TOKEN— export =your_tokenMCP4_FILTER_MAX_VALUES— Max values per filtering key (default: 10)MCP4_HELPMCP4_HIDDEN_PROFILES— Comma-separated profile ids/names/aliases to hide from the index page (profiles remain fully functional).MCP4_HOST— Bind address (default: 127.0.0.1)MCP4_HTTP_PROFILE_ROUTING— Enable profile routing (/profile/:id/mcp). If enabled without a default profile, /mcp is not registered.MCP4_LIST_PROFILESMCP4_LOG_FORMAT— console (default) or jsonMCP4_LOG_LEVEL— debug, info (default), warn, errorMCP4_OAUTH_AUTHORIZATION_URL— 1. Explicit URLs: , MCP4_OAUTH_TOKEN_URL (highest priority)MCP4_OAUTH_CLIENT_ID— export =your_dcr_client_idMCP4_OAUTH_CLIENT_SECRET— export =your_dcr_client_secretMCP4_OAUTH_CLIENT_STORE_MAX_CLIENTS— Max dynamic OAuth clients stored in memory (default: 1000)MCP4_OAUTH_ISSUER— 2. Explicit issuer: (auto-derives standard OAuth paths)MCP4_OAUTH_RATE_LIMIT_MAX— Max OAuth requests per window (default: 10)MCP4_OAUTH_RATE_LIMIT_WINDOW_MS— OAuth rate limit window (default: 60000 = 1 minute)MCP4_OAUTH_REDIRECT_URI— export =http://127.0.0.1:3003/oauth/callbackMCP4_OAUTH_REFRESH_THRESHOLD_MS— Refresh access tokens this many ms before expiry (default: 60000 = 60s)MCP4_OAUTH_SESSION_TIMEOUT_MS— OAuth session timeout for sessions with refresh tokens (default: 86400000 = 24h, 0 = unlimited)MCP4_OAUTH_TOKEN_URL— 1. Explicit URLs: MCP4_OAUTH_AUTHORIZATION_URL, (highest priority)MCP4_OPENAPI_SPEC_PATH— export =./incomplete-spec.yamlMCP4_PARAM_FILTER— Baseline parameter filter using the same format as X-Mcp4-ParamsMCP4_PORT— Port (default: 3003)MCP4_PROFILE— Profile ID for resolving profiles from a directory (used by --profile)MCP4_PROFILES_DIR— Profiles are resolved from ./profiles path by default. If that directory is missing, the bundled npm package profiles are used. Override with --profiles-dir or .MCP4_PROFILE_PATH— Profile JSON path (default: auto-generate tools from OpenAPI spec; warning logged if tool exceeds 60 parameters)MCP4_SSRF_ALLOW_PRIVATE_NETWORK— Set to true to allow private/loopback/link-local targets in SSRF validation paths, including bootstrap URL checks.MCP4_TOKEN_MAX_LENGTH— Maximum token length in characters (default: 4096, raised from 1000 in Phase 03.4 to accommodate encrypted token envelopes)MCP4_TOOLNAME_MAX— Maximum tool name length (default: 45)MCP4_TOOLNAME_MIN_LENGTH— Minimum length in chars for balanced strategy (default: 20)MCP4_TOOLNAME_MIN_PARTS— Minimum parts for balanced strategy (default: 3)MCP4_TOOLNAME_SIMILARITY_THRESHOLD— Similarity threshold for warning examples (default: 0.75)MCP4_TOOLNAME_SIMILAR_TOP— How many similar operationId pairs to show in warnings (default: 3)MCP4_TOOLNAME_STRATEGY— Shortening strategy: nonebalancediterativehashauto (default: none)MCP4_TOOLNAME_WARN_ONLY— Only warn, don't shorten: truefalse (default: true)MCP4_TOOL_FILTER_ALLOW_CATEGORIES— Comma-separated operation categories to allow (list and/or read). Composite tools are allowed only if all steps are within the allowed categories.MCP4_TOOL_FILTER_ALLOW_NAMES— Comma-separated tool names to keep (exact match, case-sensitive)MCP4_TOOL_FILTER_ALLOW_NAME_REGEX— Comma-separated regex patterns to allow (auto-anchored unless already wrapped with ^ and $)MCP4_TOOL_FILTER_DENY_NAMES— Comma-separated tool names to excludeMCP4_TOOL_FILTER_DENY_NAME_REGEX— Comma-separated regex patterns to exclude (auto-anchored)MCP4_TOOL_FILTER_WARN_THRESHOLD_PCT— Warn when filtered percentage exceeds this threshold (default: 90)MCP4_TRANSPORT— stdio (default) or httpMCP4_TRUST_BOOTSTRAP_URLS— Set to true to skip SSRF checks for bootstrap URL fetches (remote OpenAPI spec loading and OAuth metadata discovery). Default is secure mode (false).MCP4_VERSIONMCP_PROXY_CLIENT_IDMCP_PROXY_CLIENT_SECRETMERGE_EXECUTOR_METHODTEST_API_KEY_ATEST_API_KEY_BTEST_AUTH_URLTEST_FACTORY_E2E_KEYTEST_GATE_MODETEST_ISSUERTEST_TOKEN_URLUPSTREAM_SECRETUPSTREAM_SECRET_TEST_VARYOUTRACK_TOKEN— Profile auth env vars: Use profile-specific names for value_from_env (for example, GITLAB_TOKEN, ) instead of the generic MCP4_API_TOKEN.[](https://m8ven.ai/mcp/davidruzicka-mcp4openapi-1e1mq2)