
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
openapi-mcpserver-generator
Advanced tools
A command-line tool that generates Model Context Protocol (MCP) server code from OpenAPI specifications. This tool helps you quickly create an MCP server that acts as a bridge between LLMs (Large Language Models) and your API.
English | 简体中文
This repo is originally forked from openapi-mcp-generator, and add some additional features:
$ref in openapi specifications# Install globally from npm
npm install -g openapi-mcpserver-generator
# Or with yarn
yarn global add openapi-mcpserver-generator
# Or with pnpm
pnpm add -g openapi-mcpserver-generator
Generate an MCP server from an OpenAPI specification:
openapi-mcpserver-generator --openapi path/to/openapi.json --output /Path/to/output
| Option | Alias | Description | Default |
|---|---|---|---|
--openapi | -o | Path or URL to OpenAPI specification | (required) |
--output | -d | Output directory for generated files | ./mcp-server |
--name | -n | Name for the MCP server | openapi-mcp-server |
--version | -v | Version for the MCP server | 1.0.0 |
--transport | -t | Transport mechanism (stdio, websocket, http) | stdio |
--help | -h | Show help information |
Generate from a local OpenAPI file:
openapi-mcpserver-generator --openapi ./specs/petstore.json --output ./petstore-mcp
Generate from a remote OpenAPI URL:
openapi-mcpserver-generator --openapi https://petstore3.swagger.io/api/v3/openapi.json --output ./petstore-mcp
The tool generates the following files in the output directory:
server.js - The main MCP server implementationpackage.json - Dependencies and scriptsREADME.md - Documentation for the generated server.env.example - Template for environment variablestypes.d.ts - TypeScript type definitions for the APItsconfig.json - TypeScript configurationDockerfile - Dockerfile.dockerignore - Docker ignore fileAfter generating your MCP server:
Navigate to the generated directory:
cd my-mcp-server
Install dependencies:
npm install
Create an environment file:
cp .env.example .env
Edit .env to set your API base URL and any required headers:
API_BASE_URL=https://api.example.com
API_HEADERS=Authorization:Bearer your-token-here
Start the server:
npm start
Suggest use mcpclihost as MCP host to take a try.
This tool(mcpclihost) could support both Azure Openai and deepseek
You can add generated MCP server congiguration like this:
{
"mcpServers": {
"petstore-mcp": {
"command": "/usr/local/bin/node",
"args": [
"/Users/lipeng/workspaces/github.com/vincent-pli/openapi-mcpserver-generator/petstore-mcp/server.js",
"run"
]
}
}
}
to the ~/.mcp.json(default mcp server configuration path of mcpclihost), then take a try
Openapi 3.0 support 4 security types:
"securitySchemes": {
"my_api_key": {
"type": "apiKey",
"name": "api_key",
"in": "header"
}
}
Expect a env param named upper cased MY_API_KEY_{securitySchemes.my_api_key.name}, in this case, it should be: MY_API_KEY_API_KEY defined in .env
"securitySchemes": {
basicAuth: {
type: "http",
scheme: "basic"
}
}
it try to find BASICAUTH_USERNAME and BASICAUTH_PASSWORD in .env
"securitySchemes": {
basicAuth: {
type: "http",
scheme: "bearer"
}
}
it try to find BASICAUTH_BEARERTOKEN in .env
access token, then set it to .env as this:API_HEADERS=Authorization:Bearer your-access-token-here
Apache 2.0
FAQs
Generate MCP server code from OpenAPI specifications
The npm package openapi-mcpserver-generator receives a total of 5 weekly downloads. As such, openapi-mcpserver-generator popularity was classified as not popular.
We found that openapi-mcpserver-generator demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.