Mcp Openapi — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Mcp Openapi (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Turn any OpenAPI spec into MCP tools for Claude — zero config, instant API access.
Point mcp-openapi-runner at any OpenAPI 3.x spec and Claude can call every endpoint through natural language. No custom integration code. No manual tool definitions. One line of config.
| Without mcp-openapi | With mcp-openapi |
|---|---|
| Write custom MCP server per API | One config line per API |
| Define tool schemas manually | Auto-generated from OpenAPI spec |
| Handle auth, params, body yourself | Built-in auth + parameter handling |
| Maintain code as API evolves | Spec changes = tools update automatically |
Add to your Claude Desktop / Claude Code / Cursor / Cline MCP config:
{
"mcpServers": {
"petstore": {
"command": "npx",
"args": ["-y", "mcp-openapi-runner", "--spec", "https://petstore3.swagger.io/api/v3/openapi.json"]
}
}
}That's it. Claude can now discover and call every endpoint in that API.
You: What pets are available? Add a new dog named Buddy.
>
Claude: Let me check what's available. [calls `list_endpoints` → discovers `findPetsByStatus`, `addPet`, ...] [calls `call_endpoint` → `findPetsByStatus` with `status=available`]
>
There are 3 pets currently available. Now I'll add Buddy... [calls `call_endpoint` → `addPet` with `{"name":"Buddy","status":"available"}`]
>
Done! Buddy has been added with ID 12345.
$ref auto-resolved--filter--header--server-urllist_endpoints → call_endpoint workflow{
"mcpServers": {
"stripe": {
"command": "npx",
"args": ["-y", "mcp-openapi-runner", "--spec", "https://raw.githubusercontent.com/stripe/openapi/master/openapi/spec3.json"],
"env": {
"OPENAPI_BEARER_TOKEN": "sk_test_..."
}
}
}
}{
"mcpServers": {
"github": {
"command": "npx",
"args": ["-y", "mcp-openapi-runner",
"--spec", "https://raw.githubusercontent.com/github/rest-api-description/main/descriptions/api.github.com/api.github.com.json",
"--filter", "repos"],
"env": {
"OPENAPI_BEARER_TOKEN": "ghp_..."
}
}
}
}{
"mcpServers": {
"internal": {
"command": "npx",
"args": ["-y", "mcp-openapi-runner", "--spec", "http://localhost:8080/openapi.json"],
"env": {
"OPENAPI_API_KEY": "dev-key-123"
}
}
}
}{
"mcpServers": {
"jira": {
"command": "npx",
"args": ["-y", "mcp-openapi-runner",
"--spec", "https://dac-static.atlassian.com/cloud/jira/platform/swagger-v3.v3.json",
"--server-url", "https://your-domain.atlassian.net",
"--filter", "issue"],
"env": {
"OPENAPI_BASIC_USER": "[email protected]",
"OPENAPI_BASIC_PASS": "your-api-token"
}
}
}
}Pass credentials via environment variables:
{
"mcpServers": {
"my-api": {
"command": "npx",
"args": ["-y", "mcp-openapi-runner", "--spec", "https://api.example.com/openapi.json"],
"env": {
"OPENAPI_BEARER_TOKEN": "your-token-here"
}
}
}
}| Variable | Description |
|---|---|
OPENAPI_BEARER_TOKEN | Bearer token → Authorization: Bearer <token> |
OPENAPI_API_KEY | API key value |
OPENAPI_API_KEY_HEADER | Header name for API key (default: X-Api-Key) |
OPENAPI_BASIC_USER | HTTP Basic auth username |
OPENAPI_BASIC_PASS | HTTP Basic auth password |
npx mcp-openapi-runner --spec <url-or-path> [options]
Options:
--spec Path or URL to an OpenAPI 3.x spec (JSON or YAML)
--server-url Override the base URL from the spec
--filter Only expose endpoints matching a pattern (path, tag, or operationId)
--header Add custom header to all requests ("Name: Value", repeatable)
--help Show help# Basic usage
npx mcp-openapi-runner --spec https://petstore3.swagger.io/api/v3/openapi.json
# Only pet-related endpoints
npx mcp-openapi-runner --spec ./openapi.yaml --filter pets
# Point at local dev server
npx mcp-openapi-runner --spec ./openapi.yaml --server-url http://localhost:3000
# Custom headers
npx mcp-openapi-runner --spec ./openapi.yaml --header "X-Tenant: acme" --header "X-Debug: true"
# With auth
OPENAPI_BEARER_TOKEN=mytoken npx mcp-openapi-runner --spec https://api.example.com/openapi.jsonmcp-openapi-runner exposes exactly two tools:
| Tool | Description |
|---|---|
list_endpoints | Returns all operations grouped by tag with operationIds, methods, paths, and parameters |
call_endpoint | Executes any operation by operationId with path/query/header/body parameters |
The two-tool design means Claude always has a clear workflow: discover → call.
$ref schemas using @apidevtools/swagger-parser--filter is setlist_endpoints generates a human+LLM-readable summary of all operationscall_endpoint resolves params, builds the URL, attaches auth + custom headers, returns the responseContributions welcome! See CONTRIBUTING.md for guidelines.
MIT
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.