
Security News
PHP Foundation Says Chainguard Broke Security Embargo Ahead of Emergency Patches
The PHP Foundation says Chainguard broke a security embargo ahead of critical RCE patches, as leaks disrupted the coordinated release.
@kaiva/bridge
Advanced tools
Turn an OpenAPI spec, database or documents into a fully managed MCP server. Kaiva Bridge CLI.
Kaiva Bridge turns your API, database or documents into a managed MCP server that
Claude, ChatGPT, Cursor, VS Code and other AI clients can use. This page covers the
Kaiva Bridge connector, ai.kaiv/bridge, first; the command-line tool follows.
ai.kaiv/bridge)Kaiva Bridge is also an MCP server itself, so your AI client can create and manage
MCP servers from inside a chat. It is listed in the official MCP Registry as
ai.kaiv/bridge and in Claude's connector directory.
https://api.kaiv.ai/api/bridge/manage/mcp (Streamable HTTP)list_my_servers, get_server, create_server (drafts a server from an
OpenAPI spec URL) and reintrospect_server (refreshes a server's tools when the API
changes).The connector drafts and lists. Publishing a server and switching its tools on happen in the console, by you.
VS Code and GitHub Copilot: click Add to VS Code on kaiv.ai/bridge,
or run MCP: Add Server in VS Code with the address above, then sign in when asked.
Claude: claude.ai/directory/kaiva-bridge.
Claude Code: claude mcp add --transport http --scope user kaiva-bridge https://api.kaiv.ai/api/bridge/manage/mcp.
Cursor and ChatGPT: the Add menu on kaiv.ai/bridge.
Then ask: "List my Kaiva Bridge servers" or "Create a Kaiva Bridge server from https://petstore3.swagger.io/api/v3/openapi.json".
Publish any API or database as a live MCP server, from your terminal.
Kaiva Bridge turns an OpenAPI spec, a database (PostgreSQL, MySQL, MariaDB or SQL Server) or a remote MCP server into a managed MCP server your agents can call. This CLI drives it over the Management API. Every setup command is safe to run again.
Connect your AI agent to APIs, databases and documents with Kaiva Bridge. Install the skill so your coding agent can set up managed MCP connections for you. Try public APIs without an account.
Works with Claude Code, Codex, Cursor, Gemini CLI, GitHub Copilot and other compatible coding agents.
npx skills add ai-kaiva/bridge
Nothing to install. Node 18+ has everything:
npx @kaiva/bridge help
For a public API spec, one command gives you a working MCP server. No account, no login:
npx @kaiva/bridge try --openapi https://petstore3.swagger.io/api/v3/openapi.json
You get the server's address, a key for that one server, and a claim link. The server
offers only the spec's GET operations, and lasts 72 hours or 500 calls. Open the claim
link to keep it in your workspace: it keeps its address and your plan's limits apply.
The key stops working at claim, so connect your AI client again from the console. Then
you can add an API key and switch on other operations. Coding agents can do this
themselves (--json prints one JSON object).
In a cloud agent sandbox (Codex cloud, Claude Code on the web), allow the domains
api.kaiv.ai and registry.npmjs.org first: their network access is off or limited by
default.
claude plugin marketplace add ai-kaiva/bridge
claude plugin install kaiva-bridge@kaiva
Or copy just the skill: npx @kaiva/bridge skill install.
For a Postgres database that only the AI clients on your machine use, Kaiva Postgres
MCP is a free, open-source MCP server that runs
locally and only reads. It replaces the archived @modelcontextprotocol/server-postgres:
change the package name and nothing else changes.
claude mcp add postgres -- npx -y @kaiva/postgres-mcp postgresql://localhost/mydb
# or, from the same plugin marketplace as above (reads DATABASE_URL from your environment)
claude plugin install postgres-mcp@kaiva
When you need the same database in Claude.ai or ChatGPT, or for your team, push --db below
serves it from Bridge.
npx @kaiva/bridge login
The terminal shows a code and opens the console. Enter the code there and approve
it (owner or admin of the workspace). The key is saved for this machine in
~/.config/kaiva-bridge/credentials.json, readable only by you. whoami shows
the workspace and key in use; logout revokes the key and removes it.
For CI and scripts, use a Management key from the console (Keys & access, key type Management) instead. When set, it is used in place of a saved login:
export KAIVA_BRIDGE_TOKEN=kv_mgmt_...
logout revokes only a saved login. A key you supply in KAIVA_BRIDGE_TOKEN is
yours to manage: unset it, and revoke it in the console when it is no longer
needed. Signing in again revokes the login it replaces.
Management keys are refused by the MCP gateway, and gateway keys are refused by the Management API: the two credential types are never interchangeable.
# An API spec (only operations that read are exposed with --read-only)
npx @kaiva/bridge push my-api --openapi https://api.example.com/openapi.json --read-only
# A database: DATABASE_URL from the environment or .env; Postgres, MySQL, MariaDB or SQL Server
npx @kaiva/bridge push shop-db --db --read-only
# → LIVE https://api.kaiv.ai/api/bridge/mcp/shop-db-a1b2c3d4
# → check first call: get_orders answered in 84ms (and what the AI is given)
# Documents: PDF, Word, PNG, JPEG, text or Markdown files, or a folder of them
npx @kaiva/bridge push handbook --docs ./policies
# waits until each file is read, then → LIVE https://api.kaiv.ai/api/bridge/mcp/handbook-a1b2c3d4
npx @kaiva/bridge install my-api --client claude-code # or --client cursor
install adds the server to Claude Code (this folder's .mcp.json, or --global)
or Cursor (~/.cursor/mcp.json, or --project), keeping every other entry. The
client signs in with your Kaiva account the first time; --key writes a key for
this one server instead. --dry-run shows the change; uninstall removes it.
For any other MCP client, key <server-id> --label <client> --replace makes a
gateway key to paste with the endpoint. Run the same commands again and nothing
is duplicated: push reuses the server with that name, install leaves an
existing entry as it is, and key --replace swaps the key with that label.
npx @kaiva/bridge skill install # adds the setup skill to Claude Code (~/.claude/skills)
Then ask: "connect my database to Claude Code with Kaiva Bridge". The skill runs the commands below, asks you before connecting without certificate checks or exposing operations that write, and confirms with a first tool call.
Runnable scripts in examples/:
database-to-claude-code.sh: a Postgres, MySQL or MariaDB database into Claude Codeopenapi-to-cursor.sh: an OpenAPI spec into Cursor for this projectcall-from-your-app.mjs: call your MCP server from your own Node app, no dependencies| Command | What it does |
|---|---|
push <name> --openapi <url> | Create + introspect + expose + publish from an OpenAPI spec |
push <name> --mcp <url> | Wrap an existing remote MCP server, choosing which of its tools to offer |
push <name> --postgres <conn> | Read-only tools from a Postgres database |
push <name> --mysql <conn> | Read-only tools from a MySQL or MariaDB database |
push <name> --graphql <endpoint> | Read tools from a GraphQL API's queries (mutations are not offered) |
push <name> --sqlserver <conn> | Read-only tools from a SQL Server or Azure SQL database (sqlserver://… or Server=…;Database=…;User ID=…;Password=…) |
push <name> --docs <files or folders> | Documents your AI can search and read, page by page; the same file name again replaces that document. --no-wait returns once the files are sent |
push <name> --db [--db-env NAME] | The database in DATABASE_URL (or NAME), from the environment or .env.local/.env; the engine is told apart by the address, which never appears on the command line |
push … --read-only | Expose only operations that read; writes stay off until you choose them |
push … --no-check | Skip the setup check every push and try ends with: one real call, writes switched on, the tool list's size and tables that look private |
push … --ca-file <pem> / --no-verify-tls | A database with a self-signed certificate: check it against your provider's CA, or connect without checking |
login [--no-browser] | Approve this machine in the console and save a key for it |
whoami | The workspace, account and key in use |
logout | Revoke this machine's key and remove it |
skill install [--project] | Add the setup skill for coding agents |
install <server> --client claude-code|cursor | Add a live server to the client's config; --key, --dry-run, --global (Claude Code), --project (Cursor) |
uninstall <server> --client claude-code|cursor | Remove it, and revoke a key install added |
doctor <server> [--call <tool>] | Check reachability, sign-in, publication, the MCP handshake and tool list; each step passes, fails with a code and a fix, or says it did not run. --call makes one call with a tool that reads. Ends with a receipt for support (no secrets) |
servers | List servers with state and source |
publish <server-id> | Publish a draft server |
key <server-id> [--label L] [--replace] | Mint a server-scoped gateway key (shown once); --replace revokes the earlier key with that label |
introspect <server-id> | Re-read the source. Exits 3 if a contract change was held |
revisions <server-id> | Contract history: when it changed and which tool |
promote <server-id> | Publish the held change |
reject <server-id> | Discard it and restore what is being served |
auto-publish <server-id> [--off] | Publish contract changes without review |
invoke <server-id> <tool-id> [--args '{"k":"v"}'] | Test-call a tool through the real governed path (audited) |
logs [--limit 50] | Tail the audit log |
metrics [--range 24h] | Workspace KPIs (1h · 24h · 7d · 30d) |
--json on push, key, install, whoami and doctor prints one JSON result on stdout (progress goes to
stderr), for scripts and agents. KAIVA_BRIDGE_URL overrides the API base
(defaults to https://api.kaiv.ai/api/bridge/v1).
Call a live example server from your browser, no account needed: https://app.kaiv.ai/try
MIT © SLATEAI LIMITED · kaiv.ai/bridge
FAQs
Turn an OpenAPI spec, database or documents into a fully managed MCP server. Kaiva Bridge CLI.
We found that @kaiva/bridge demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
The PHP Foundation says Chainguard broke a security embargo ahead of critical RCE patches, as leaks disrupted the coordinated release.

Security News
PHP releases emergency patches for two critical RCE vulnerabilities as agencies urge organizations to take unpatched sites offline.

Threat Research
/Security News
A supply chain attack compromised LiteLLM 1.107.0 on PyPI and Docker, spreading malware that steals cloud credentials, developer secrets, and AI provider keys.