
Product
Socket Now Protects the Microsoft Edge Extension Ecosystem
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.
agentify-openapi
Advanced tools
Turn any OpenAPI/Swagger spec into an agent-ready MCP server. Point it at a spec and every operation becomes a tool an agent can call.
Turn any OpenAPI / Swagger spec into an agent-ready MCP server.
Point it at a spec — a URL, a file, OpenAPI 3.x or Swagger 2.0 — and every operation becomes a tool an AI agent can call. No code generation, no per-API boilerplate, no hosting. One command.
npx agentify-openapi https://petstore3.swagger.io/api/v3/openapi.json --list
Swagger Petstore - OpenAPI 3.0 v1.0.27
Base URL: https://petstore3.swagger.io/api/v3
Tools: 19
getPetById
Find pet by ID.
findPetsByStatus
Finds Pets by status.
...
"Today, agents have to operate software designed for humans. The interfaces of the future will be built for agents — APIs, MCPs, CLIs — with agents as first-class citizens." — YC RFS: Software for Agents
There are tens of thousands of APIs that already describe themselves with an OpenAPI
document. agentify makes every one of them agent-native, instantly, without anyone
hand-writing an integration.
Add to your MCP client config (e.g. Claude Desktop / Claude Code):
{
"mcpServers": {
"petstore": {
"command": "npx",
"args": ["-y", "agentify-openapi", "https://petstore3.swagger.io/api/v3/openapi.json"]
}
}
}
The agent now has one tool per API operation. Calling a tool builds the HTTP request (path params, query string, headers, JSON body) and returns the live response.
Provide credentials via environment variables — agentify reads the spec's declared
security scheme to find the right header name when it can:
| Variable | Effect |
|---|---|
AGENTIFY_BEARER_TOKEN | Authorization: Bearer <token> |
AGENTIFY_BASIC_USER / AGENTIFY_BASIC_PASS | HTTP basic auth |
AGENTIFY_API_KEY | API key (sent as a header by default) |
AGENTIFY_API_KEY_HEADER | Override the api-key header name |
AGENTIFY_API_KEY_QUERY | Send the api key as a query param instead |
You can also inject raw headers from the CLI: --header "X-Org-Id: 42" (repeatable).
agentify <spec-url-or-file> [options]
--base-url <url> Override the API base URL from the spec
--header "K: V" Add a raw header to every request (repeatable)
--name <name> Override the MCP server name
--list Print the discovered tools and exit (no server)
-h, --help Show help
A small, pure pipeline — each stage is independently unit-tested:
spec ──▶ operations ──▶ tool defs ──▶ http request ──▶ response
│ │ │ │ │
load & one tool JSON Schema path/query/ fetch + surface
deref per op for inputs header/body status & body
$refs + auth
Only the HTTP execution and MCP transport touch the outside world; everything else is deterministic and tested.
import { loadSpec, extractOperations, resolveBaseUrl, createServer } from "agentify-openapi";
const spec = await loadSpec("./openapi.yaml");
const tools = extractOperations(spec);
const baseUrl = resolveBaseUrl(spec);
// ...build your own MCP server, or just inspect the generated tool defs
multipart/form bodies are passed
through best-effort.cookie parameters and OAuth2 flows are not yet handled (use --header for now).npm install
npm test # vitest, 80%+ coverage enforced
npm run build # tsc -> dist/
node scripts/smoke.mjs # end-to-end MCP client smoke test (network)
MIT
FAQs
Turn any OpenAPI/Swagger spec into an agent-ready MCP server. Point it at a spec and every operation becomes a tool an agent can call.
The npm package agentify-openapi receives a total of 43 weekly downloads. As such, agentify-openapi popularity was classified as not popular.
We found that agentify-openapi demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Product
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.

Research
/Security News
Socket researchers found 18 Chrome extensions and one Edge extension delivering a wallet drainer, credential theft, and other malicious payloads.

Product
Create ClickUp tasks from Socket alerts, automate ticketing with custom rules, and keep alert and task status synchronized.