Turn any OpenAPI specification into a smaller, LLM-friendly MCP server. Enables interaction with REST APIs through MCP tools using profiles to reduce complexity.
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.
Install from
M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
When Vitest UI server is listening, arbitrary file can be read and executed
Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket
Vite has an `server.fs.deny` bypass with an invalid `request-target`
Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling
Vite's server.fs.deny bypassed with /. for files under project root
process.env. You'll be asked to provide them before it can run.ENTERPRISE_ALLOWED_ALGSENTERPRISE_AUDIENCEENTERPRISE_CATEGORIESENTERPRISE_CLAIM_MAPPINGSENTERPRISE_DEFAULT_SCOPESENTERPRISE_ISSUERENTERPRISE_MODEGITLAB_TOKEN— Profile auth env vars: Use profile-specific names for value_from_env (for example, , YOUTRACK_TOKEN) instead of the generic MCP4_API_TOKEN.IMPLEMENTOR_COMMANDIMPLEMENTOR_FALLBACK_COMMANDIMPLEMENTOR_LEASE_TTL_MINUTESIMPLEMENTOR_TASK_JSONMCP4_ALLOWED_ORIGINS— Comma-separated origins (supports exact, wildcard .domain.com, CIDR 192.168.1.0/24)MCP4_ALLOWED_UNREGISTERED_REDIRECT_URIS— Comma-separated approved redirect URI rules for unregistered OAuth clients, e.g. http://localhost,cursor:// (optional)MCP4_ALLOW_PROFILES— Comma-separated profile ids/names/aliases allowed for routed profiles.MCP4_ALLOW_PROFILES_REGEX— Regex for allowed profile ids/names/aliases (applies only when routing is enabled).MCP4_ALLOW_UNREGISTERED_CLIENTS— Allow authorize requests for unregistered OAuth clients when redirect URIs match the approved allowlist (optional, default: false)MCP4_API_BASE_URL— Override OpenAPI server URLMCP4_API_TOKEN— export =your_tokenMCP4_FILTER_MAX_VALUES— Max values per filtering key (default: 10)MCP4_HELPMCP4_HIDDEN_PROFILES— Comma-separated profile ids/names/aliases to hide from the index page (profiles remain fully functional).MCP4_HOST— Bind address (default: 127.0.0.1)MCP4_HTTP_PROFILE_ROUTING— Enable profile routing (/profile/:id/mcp). If enabled without a default profile, /mcp is not registered.MCP4_LIST_PROFILESMCP4_LOG_FORMAT— console (default) or jsonMCP4_LOG_LEVEL— debug, info (default), warn, errorMCP4_OAUTH_AUTHORIZATION_URL— 1. Explicit URLs: , MCP4_OAUTH_TOKEN_URL (highest priority)MCP4_OAUTH_CLIENT_ID— export =your_dcr_client_idMCP4_OAUTH_CLIENT_SECRET— export =your_dcr_client_secretMCP4_OAUTH_CLIENT_STORE_MAX_CLIENTS— Max dynamic OAuth clients stored in memory (default: 1000)MCP4_OAUTH_ISSUER— 2. Explicit issuer: (auto-derives standard OAuth paths)MCP4_OAUTH_RATE_LIMIT_MAX— Max OAuth requests per window (default: 10)MCP4_OAUTH_RATE_LIMIT_WINDOW_MS— OAuth rate limit window (default: 60000 = 1 minute)MCP4_OAUTH_REDIRECT_URI— export =http://127.0.0.1:3003/oauth/callbackMCP4_OAUTH_REFRESH_THRESHOLD_MS— Refresh access tokens this many ms before expiry (default: 60000 = 60s)MCP4_OAUTH_SESSION_TIMEOUT_MS— OAuth session timeout for sessions with refresh tokens (default: 86400000 = 24h, 0 = unlimited)MCP4_OAUTH_TOKEN_URL— 1. Explicit URLs: MCP4_OAUTH_AUTHORIZATION_URL, (highest priority)MCP4_OPENAPI_SPEC_PATH— export =./incomplete-spec.yamlMCP4_PARAM_FILTER— Baseline parameter filter using the same format as X-Mcp4-ParamsMCP4_PORT— Port (default: 3003)MCP4_PROFILE— Profile ID for resolving profiles from a directory (used by --profile)MCP4_PROFILES_DIR— Profiles are resolved from ./profiles path by default. If that directory is missing, the bundled npm package profiles are used. Override with --profiles-dir or .MCP4_PROFILE_PATH— Profile JSON path (default: auto-generate tools from OpenAPI spec; warning logged if tool exceeds 60 parameters)MCP4_SSRF_ALLOW_PRIVATE_NETWORK— Set to true to allow private/loopback/link-local targets in SSRF validation paths, including bootstrap URL checks.MCP4_TOKEN_MAX_LENGTH— Maximum token length in characters (default: 4096, raised from 1000 in Phase 03.4 to accommodate encrypted token envelopes)MCP4_TOOLNAME_MAX— Maximum tool name length (default: 45)MCP4_TOOLNAME_MIN_LENGTH— Minimum length in chars for balanced strategy (default: 20)MCP4_TOOLNAME_MIN_PARTS— Minimum parts for balanced strategy (default: 3)MCP4_TOOLNAME_SIMILARITY_THRESHOLD— Similarity threshold for warning examples (default: 0.75)MCP4_TOOLNAME_SIMILAR_TOP— How many similar operationId pairs to show in warnings (default: 3)MCP4_TOOLNAME_STRATEGY— Shortening strategy: nonebalancediterativehashauto (default: none)MCP4_TOOLNAME_WARN_ONLY— Only warn, don't shorten: truefalse (default: true)MCP4_TOOL_FILTER_ALLOW_CATEGORIES— Comma-separated operation categories to allow (list and/or read). Composite tools are allowed only if all steps are within the allowed categories.MCP4_TOOL_FILTER_ALLOW_NAMES— Comma-separated tool names to keep (exact match, case-sensitive)MCP4_TOOL_FILTER_ALLOW_NAME_REGEX— Comma-separated regex patterns to allow (auto-anchored unless already wrapped with ^ and $)MCP4_TOOL_FILTER_DENY_NAMES— Comma-separated tool names to excludeMCP4_TOOL_FILTER_DENY_NAME_REGEX— Comma-separated regex patterns to exclude (auto-anchored)MCP4_TOOL_FILTER_WARN_THRESHOLD_PCT— Warn when filtered percentage exceeds this threshold (default: 90)MCP4_TRANSPORT— stdio (default) or httpMCP4_TRUST_BOOTSTRAP_URLS— Set to true to skip SSRF checks for bootstrap URL fetches (remote OpenAPI spec loading and OAuth metadata discovery). Default is secure mode (false).MCP4_VERSIONMCP_PROXY_CLIENT_IDMCP_PROXY_CLIENT_SECRETMERGE_EXECUTOR_METHODTEST_API_KEY_ATEST_API_KEY_BTEST_AUTH_URLTEST_FACTORY_E2E_KEYTEST_GATE_MODETEST_ISSUERTEST_TOKEN_URLUPSTREAM_SECRETUPSTREAM_SECRET_TEST_VARYOUTRACK_TOKEN— Profile auth env vars: Use profile-specific names for value_from_env (for example, GITLAB_TOKEN, ) instead of the generic MCP4_API_TOKEN.[](https://m8ven.ai/mcp/davidruzicka-mcp4openapi-1e1mq2)