Back to MCP Trust Indexm8ven
58
/ 100
25 days ago
glama

mcp-openapi-bridge

Bridges any OpenAPI 3.x REST API to Claude Code by automatically generating one tool per endpoint from your spec, with full argument validation and auth support.

→ murilojrpereira/mcp-openapi-bridge· listed on glama
Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
⚠️
Known vulnerabilities in dependencies: 3 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
✅
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
✅
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 3 credentials: MCP_AUTH_TOKEN, OPENAPI_API_KEY, OPENAPI_TOKEN
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// known CVEs in dependencies3 high1 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.10.2GHSA-345p-7cg4-v4c7

@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

high@modelcontextprotocol/sdk@1.10.2GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

high@modelcontextprotocol/sdk@1.10.2GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

lowyaml@2.7.0GHSA-48c2-rrv3-qjmp

yaml is vulnerable to Stack Overflow via deeply nested YAML collections

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
configAPI_BASE_URL— 5. Executes HTTP requests against and returns the response
🔐 secretMCP_AUTH_TOKEN— Bearer token required by the /mcp HTTP endpoint. Recommended for any public-routable deployment. unauthenticated if unset
configMCP_TRANSPORT— stdio or http stdio
🔐 secretOPENAPI_API_KEY— API key value (pair with one of the two below)
configOPENAPI_API_KEY_HEADER— Header name for API key, e.g. X-API-Key
configOPENAPI_API_KEY_PARAM— Query param name for API key, e.g. api_key
configOPENAPI_CUSTOM_HEADERS— Extra headers for every call: X-Foo=bar,X-Baz=qux
configOPENAPI_EXCLUDE_TAGS— Comma-separated tags to exclude none
configOPENAPI_INCLUDE_TAGS— Comma-separated tags to include all
configOPENAPI_MAX_TOOLS— 3. Registers one MCP tool per operation (filtered by , tags, or path prefix)
configOPENAPI_PATH_PREFIX— Only include paths starting with this prefix all
configOPENAPI_SPEC_CACHE_TTL_SECONDS— When using OPENAPI_SPEC_URL, the spec is cached locally for 1 hour (in ~/.cache/mcp-openapi-bridge/). Override with .
configOPENAPI_SPEC_PATH— 1. Loads your OpenAPI 3.x spec from a local file () or URL (OPENAPI_SPEC_URL)
configOPENAPI_SPEC_URL— 1. Loads your OpenAPI 3.x spec from a local file (OPENAPI_SPEC_PATH) or URL ()
🔐 secretOPENAPI_TOKEN— e =your-token
configPORT— HTTP port (when MCP_TRANSPORT=http) 8080
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 5 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/murilojrpereira-mcp-openapi-bridge-i9t19h)](https://m8ven.ai/mcp/murilojrpereira-mcp-openapi-bridge-i9t19h)
commit: 457af5a4c0026cfee4eae9f23f412ce791c1801f
code hash: 73e01b6595459e0fda1b3313edf96aae2f6c6efdd68a0b8746ed28d73af97e97
verified: 7/6/2026, 10:31:35 AM
view raw JSON →