
Security News
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.
An MCP server that bridges OpenAPI specifications to MCP tools - scan a folder for spec files and automatically generate corresponding tools
An MCP server that turns OpenAPI specifications into MCP tools. Scan a folder for OpenAPI spec files and automatically generate corresponding tools. No configuration files, no separate servers - just drop specs in a folder and get tools.
Built with FastMCP for TypeScript.
.env file with {API_NAME}_API_KEY patternpetstore_getPet, github_getUser)npm install -g specbridge
mkdir ~/mcp-apis
Drop any .json, .yaml, or .yml OpenAPI specification files into your specs folder:
# Example: Download the Petstore spec
curl -o ~/mcp-apis/petstore.json https://petstore3.swagger.io/api/v3/openapi.json
Create a .env file in your specs folder:
# ~/mcp-apis/.env
PETSTORE_API_KEY=your_api_key_here
GITHUB_TOKEN=ghp_your_github_token
OPENAI_API_KEY=sk-your_openai_key
For Claude Desktop or Cursor, add to your MCP configuration:
If installed on your machine:
{
"mcpServers": {
"specbridge": {
"command": "specbridge",
"args": ["--specs", "/path/to/your/specs/folder"]
}
}
}
Otherwise:
{
"mcpServers": {
"specbridge": {
"command": "npx",
"args": ["-y", "specbridge", "--specs", "/absolute/path/to/your/specs"]
}
}
}
That's it! Your OpenAPI specs are now available as MCP tools. ✅
# Default: stdio transport, current directory
specbridge
# Custom specs folder
specbridge --specs ~/my-api-specs
# HTTP transport mode
specbridge --transport httpStream --port 8080
# List all loaded specifications and their tools
specbridge list
# List specs from custom folder
specbridge list --specs ~/my-api-specs
## 🔑 Authentication Patterns
The server automatically detects authentication from environment variables using these patterns:
| Pattern | Auth Type | Usage |
|---------|-----------|--------|
| `{API_NAME}_API_KEY` | 🗝️ API Key | `X-API-Key` header |
| `{API_NAME}_TOKEN` | 🎫 Bearer Token | `Authorization: Bearer {token}` |
| `{API_NAME}_BEARER_TOKEN` | 🎫 Bearer Token | `Authorization: Bearer {token}` |
| `{API_NAME}_USERNAME` + `{API_NAME}_PASSWORD` | 👤 Basic Auth | `Authorization: Basic {base64}` |
The `{API_NAME}` is derived from the filename of your OpenAPI spec:
- `petstore.json` → `PETSTORE_API_KEY`
- `github-api.yaml` → `GITHUB_TOKEN`
- `my_custom_api.yml` → `MYCUSTOMAPI_API_KEY`
## 🏷️ Tool Naming
Tools are automatically named using this pattern:
- **With operationId**: `{api_name}_{operationId}`
- **Without operationId**: `{api_name}_{method}_{path_segments}`
Examples:
- `petstore_getPetById` (from operationId)
- `github_get_user_repos` (generated from `GET /user/repos`)
## 📁 File Structure
your-project/ ├── api-specs/ # Your OpenAPI specs folder │ ├── .env # Authentication credentials │ ├── petstore.json # OpenAPI spec files │ ├── github.yaml # │ └── custom-api.yml # └── mcp-config.json # MCP client configuration
## 📄 Example OpenAPI Spec
Here's a minimal example that creates two tools:
```yaml
# ~/mcp-apis/example.yaml
openapi: 3.0.0
info:
title: Example API
version: 1.0.0
servers:
- url: https://api.example.com
paths:
/users/{id}:
get:
operationId: getUser
summary: Get user by ID
parameters:
- name: id
in: path
required: true
schema:
type: string
responses:
'200':
description: User found
/users:
post:
operationId: createUser
summary: Create a new user
requestBody:
required: true
content:
application/json:
schema:
type: object
properties:
name:
type: string
email:
type: string
responses:
'201':
description: User created
This creates tools named:
example_getUserexample_createUserSpecbridge automatically provides three built-in tools that allow you to manage your OpenAPI specifications:
specbridge_list_specsLists all OpenAPI specification files in your specs folder with details like file size and modification date.
specbridge_get_specRetrieves the complete content of a specific OpenAPI specification file.
filename - The name of the spec file (e.g., "petstore.json", "github.yaml")specbridge_update_specUpdates the content of a specific OpenAPI specification file. Automatically validates the content and reloads the tools.
filename - The name of the spec file to updatecontent - The new content for the specification fileThese tools enable powerful workflows:
Example workflow:
specbridge_list_specs - See what specs are availablespecbridge_get_spec - Retrieve a spec that needs enhancementspecbridge_update_spec - Save the enhanced versionSpecbridge includes built-in integration with APIs.guru, the largest directory of OpenAPI specifications with 3000+ public APIs. This enables powerful discovery and installation workflows:
apisguru_listAPIs - Browse all 3000+ APIs in the directoryapisguru_getProviders - List providers like Google, GitHub, Stripe, etc.apisguru_getMetrics - Get directory statistics (APIs, endpoints, etc.)apisguru_getProvider - Get all APIs from a specific providerapisguru_getServices - Get service names for a provider (e.g., Gmail, Drive for Google)apisguru_getAPI - Get details for a specific API versionapisguru_getServiceAPI - Get details for a specific service APIspecbridge_download_spec - Download and save any OpenAPI spec from a URLFind and add the Stripe API:
apisguru_getProvider with provider "stripe.com" - See available Stripe APIsapisguru_getAPI with provider "stripe.com" and api "2020-08-27" - Get API detailsswaggerUrl from the response with specbridge_download_spec - Download the specExplore Google APIs:
apisguru_getServices with provider "googleapis.com" - See all Google servicesapisguru_getServiceAPI with provider "googleapis.com", service "gmail", api "v1" - Get Gmail API detailsBrowse popular APIs:
apisguru_listAPIs - Get full directory (warning: large response!)Check that your OpenAPI specs are valid:
specbridge list --specs /path/to/specs
Ensure files have correct extensions (.json, .yaml, .yml)
Check the server logs for parsing errors
⚠️ Note: Specbridge works best when you use absolute paths (with no spaces) for the
--specsargument and other file paths. Relative paths or paths containing spaces may cause issues on some platforms or with some MCP clients.
.env file is in the specs directoryspecbridge list
# Clone and install
git clone https://github.com/TBosak/specbridge.git
cd specbridge
npm install
# Build
npm run build
# Test locally
npm run dev -- --specs ./examples
Contributions are welcome! Please feel free to submit issues and pull requests.
FAQs
An MCP server that bridges OpenAPI specifications to MCP tools - scan a folder for spec files and automatically generate corresponding tools
The npm package specbridge receives a total of 5 weekly downloads. As such, specbridge popularity was classified as not popular.
We found that specbridge demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.

Security News
Open source is under attack because of how much value it creates. It has been the foundation of every major software innovation for the last three decades. This is not the time to walk away from it.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.