OpenAPI to MCP

A standalone proxy that transforms any OpenAPI or Swagger-described REST API into an MCP server by mapping API operations to executable MCP tools. It enables AI clients to interact with existing web services through automated HTTP requests based on their official documentation.

→ EvilFreelancer/openapi-to-mcp · listed on glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings

⚠️

Known vulnerabilities in dependencies: 14 high

Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.

✅

No credential exfiltration, no sensitive file access, no obfuscation

Static analysis found nothing flowing your secrets to unexpected places.

✅

Open source with a license and README

Anyone can audit the code, the license is declared, and the publisher documents what it does.

🔐

You'll be asked for 1 credential: MCP_API_BEARER_TOKEN

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// required environment variables

This server reads these from process.env. You'll be asked to provide them before it can run.

configAPI_BASE_URL

configMCP_API_BASE_URL— Base URL for API requests http://127.0.0.1:3000

configMCP_API_BASIC_AUTH— Basic auth for API requests: username:password. Use when the remote API is protected by HTTP Basic Auth. If both this and MCP_API_BEARER_TOKEN are set, Bearer is used. -

🔐 secretMCP_API_BEARER_TOKEN— MCP_API_BASIC_AUTH Basic auth for API requests: username:password. Use when the remote API is protected by HTTP Basic Auth. If both this and are set, Bearer is used. -

configMCP_CONVERT_HTML_TO_MARKDOWN— Convert HTML tags in operation descriptions to Markdown format. Set to false to disable. true

configMCP_EXCLUDE_ENDPOINTS— 2. Collect operations (method + path). Filter: if MCP_INCLUDE_ENDPOINTS is set, keep only those; otherwise drop any in . Include has priority over exclude.

configMCP_HOST— Bind host 0.0.0.0

configMCP_INCLUDE_ENDPOINTS— 2. Collect operations (method + path). Filter: if is set, keep only those; otherwise drop any in MCP_EXCLUDE_ENDPOINTS. Include has priority over exclude.

configMCP_INSTRUCTIONS_FILE— Path to custom instructions file (text file with MCP server instructions) -

configMCP_INSTRUCTIONS_MODE

configMCP_LOG_LEVEL— Log levels: DEBUG, INFO, WARN, ERROR (configurable via env var, default: INFO)

configMCP_OPENAPI_SPEC— 1. Load OpenAPI spec from (URL starting with http:// or https://, or file path).

configMCP_OPENAPI_SPEC_FILE— Backward compatibility: MCP_OPENAPI_SPEC_URL and are still supported but deprecated. MCP_OPENAPI_SPEC takes precedence if set.

configMCP_OPENAPI_SPEC_URL— Backward compatibility: and MCP_OPENAPI_SPEC_FILE are still supported but deprecated. MCP_OPENAPI_SPEC takes precedence if set.

configMCP_PORT— Port for Streamable HTTP server 3100

configMCP_SERVER_NAME— Server name reported to MCP clients openapi-to-mcp

configMCP_TOOL_PREFIX— Prefix for tool names (e.g. api_ -> api_messages, api_channels) (empty)

// full audit trail

The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.

// improvement guidance — verified publishers only

We have 1 concrete improvement we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/evilfreelancer-openapi-to-mcp-1akq9f)](https://m8ven.ai/mcp/evilfreelancer-openapi-to-mcp-1akq9f)

commit: 68ed2e42c44b8e12c6d6e206c2cbc9f1cb89b5c9

code hash: b405e1515f363d6ff9b2df480b94c70dfbd6e5addf897b668dc1067ba15b0690

verified: 6/12/2026, 11:17:23 AM

view raw JSON →