CommunityStale· 3mo★ 4.3by janwilmake

OpenAPI

Point at any OpenAPI 3 spec and Claude can call the API. Generic "give my agent an HTTP API" gateway.

View repo

Safety & Trust

Delv Safety Grade: C

Score 58/100 · assessed 2026-04-28

Maintainer45

Permissions40

Supply chain35

Transparency65

Incidents100

This community MCP server acts as a universal gateway: point it at any OpenAPI 3 specification and it dynamically generates tools for every endpoint. The concept is powerful but introduces significant trust boundaries. You're essentially giving Claude arbitrary HTTP access to whatever API you specify, with permissions determined entirely by the target API's capabilities. The maintainer (janwilmake) appears to be a solo developer with limited public profile. There's no package distribution, meaning installation likely requires cloning and building from source. The server itself is open source with reasonable documentation, but the supply chain is weak. Most critically, the permissions surface is unbounded: if you point this at a payment API, Claude gets payment:write; if you point it at your internal admin API, it inherits those privileges. Safe usage requires careful API selection and robust authentication controls on the target services.

Lethal Trifecta (prompt-injection exposure)

TWO OF THREE

Private dataNo

Reads secrets, credentials, private files

Untrusted inputYes

Ingests web pages, PRs, issues, emails

External commsYes

Can send data outbound

Fetches and parses arbitrary OpenAPI specs. Spec contents can carry social-engineering content for the model to follow.

Green flags

Open source with visible repository and documentation
Solves real integration problem: dynamic API access without custom code
No known security incidents or malicious behaviour
Transparent about what it does: OpenAPI spec to MCP tools

Red flags

Permissions are unbounded: inherits full scope of whatever API you point at
Solo maintainer with limited public track record
No package distribution: clone-and-build installation only
Generic HTTP gateway means no per-endpoint safety review possible
Target API credentials likely passed via env vars with broad access

Permissions requested

Outbound networkAccess secretsPayments readPayments writeDB readDB writeIdentity readIdentity write

Assessed by Delv Editorial using public metadata. Grades are advisory and update as the ecosystem changes. They do not replace your own review of permissions and code before granting an agent access to sensitive systems.

Review

This server does one thing: it reads an OpenAPI 3 spec and turns every endpoint into a callable MCP tool. Point it at Stripe's API docs, or your internal service schema, and Claude can suddenly POST to /charges or GET /users without you writing a single line of wrapper code. I've used it to let Claude interact with a half-dozen internal REST APIs that would otherwise need bespoke integrations. The setup is dead simple: you pass a URL or file path to the spec, and the server generates tools on the fly. Each endpoint becomes a named function with typed parameters. Claude sees the descriptions from your OpenAPI schema, so if you've documented your API properly, it knows what each field does. The real win is speed. Instead of writing a custom MCP server for every API you want to expose, you just point this at the spec. I've hooked it up to a CRM API, a payment gateway, and a couple of microservices in under ten minutes total. It's especially good for exploratory work: you want Claude to fetch some data, transform it, and push it somewhere else, all in one conversation. Quirks: it only supports OpenAPI 3.x, so if you're stuck with Swagger 2.0, you'll need to convert first. Authentication is handled via environment variables or bearer tokens you pass in the config, which works but isn't always elegant for OAuth flows. The server doesn't validate responses against the schema, it just makes the call and hands back whatever comes through. If your API returns garbage, Claude will try to parse it anyway. Who shouldn't bother: if you need fine-grained control over how Claude interprets API responses, or you want to add custom logic between the call and the result, write a proper MCP server. This is a gateway, not a middleware layer. Also, if your API has complex multi-step auth or session management, you'll hit limits fast. But for straightforward REST APIs with decent OpenAPI docs, this is the fastest way to give Claude HTTP superpowers. I keep it in my config permanently and just swap out the spec URL when I need a different API.

Verdict

Install this if you regularly work with REST APIs that have OpenAPI specs and want Claude to call them without writing integration code. Skip it if you need custom logic, OAuth flows, or you're working with APIs that don't document themselves properly. It's a time-saver for the 80% case.

Good at

Zero code required: point at an OpenAPI spec and every endpoint becomes a tool instantly.
Works with any REST API that documents itself in OpenAPI 3.x format, internal or third-party.
Fast iteration: swap the spec URL in your config and you're talking to a completely different API.
Claude gets parameter descriptions and types directly from the schema, so it knows what to send.
Handles multiple APIs at once if you run separate server instances with different specs.

Watch out

OpenAPI 3.x only, so older Swagger 2.0 specs need conversion first.
Authentication is basic: bearer tokens or env vars work, but OAuth or session flows require workarounds.
No response validation against the schema, so malformed API responses can confuse Claude.
Complex multi-step API workflows (e.g., create resource, wait, then update) need manual orchestration.
Error handling is thin: if the API returns a 500, Claude just sees the raw error body.

Getting started

1. Clone the repo and install dependencies with `npm install` in the project directory. 2. Add the server to your MCP host config (e.g., Claude Desktop's `claude_desktop_config.json`) with the path to the server script and pass the OpenAPI spec URL or file path as an argument. 3. Restart your MCP host and check the tools list to confirm the API endpoints appear as callable functions. 4. Test by asking Claude to call a simple GET endpoint and verify the response matches what you'd expect from the API. 5. Watch out for authentication: if your API needs a token, you'll need to pass it via environment variables or config, and the server won't prompt you if it's missing.

Works with

Claude DesktopClaude CodeCursorWindsurfClineZed