
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
mcp-api-connect
Advanced tools
Protocol- and auth-agnostic API connector engine: send one normalized payload, reach REST or SOAP services behind any auth scheme — as a library, HTTP API, or MCP server.
One payload in, any API out. mcp-api-connect is a protocol- and auth-agnostic connector engine: describe a target service (URL, protocol, auth, request/ response shape) once, then send it a normalized payload and get a normalized response back — whether the target is a REST/JSON API, a legacy SOAP service, protected by an API key, Basic auth, a Bearer token, or OAuth2 client credentials.
It ships as three things built on the same core engine, so however you want to use it, you can:
pip install mcp-api-connect, call MCPAPIConnectEngine
directly, no server required.pip install mcp-api-connect[api], run
mcp-api-connect-api, POST to /invoke.pip install mcp-api-connect[mcp], run mcp-api-connect,
point any MCP client (Claude, etc.) at it so an agent can call registered
connectors — or arbitrary services on the fly — as tools.Every integration project reinvents the same wheel: a REST client here, a
SOAP client there, one auth flow per service, ad-hoc request/response
mapping scattered across the codebase. mcp-api-connect centralizes that into one
declarative spec (InvokeSpec) and one execution engine, so adding a new
target service is config, not code.
pip install mcp-api-connect
import asyncio
from mcp_api_connect import MCPAPIConnectEngine, InvokeSpec, Target, AuthSpec, AuthType, RequestFormat, ResponseFormat
spec = InvokeSpec(
target=Target(base_url="https://api.example.com"),
auth=AuthSpec(type=AuthType.API_KEY, config={"api_key": "secret", "header_name": "X-API-Key"}),
request_format=RequestFormat(method="POST", path="/v1/orders", content_type="json"),
response_format=ResponseFormat(content_type="json"),
)
async def main():
async with MCPAPIConnectEngine() as engine:
result = await engine.invoke(spec, {"customer": "jane"})
print(result.success, result.data)
asyncio.run(main())
pip install "mcp-api-connect[api]"
mcp-api-connect-api # serves on :8000, interactive docs at /docs
curl -X POST http://localhost:8000/invoke -H 'content-type: application/json' -d '{
"spec": {
"target": {"base_url": "https://api.example.com"},
"auth": {"type": "api_key", "config": {"api_key": "secret"}},
"request_format": {"method": "POST", "path": "/v1/orders"},
"response_format": {"content_type": "json"}
},
"payload": {"customer": "jane"}
}'
Register a reusable connector once, then invoke it by name:
curl -X POST http://localhost:8000/connectors -d '{"name": "orders-api", "spec": {...}}'
curl -X POST http://localhost:8000/connectors/orders-api/invoke -d '{"customer": "jane"}'
pip install "mcp-api-connect[mcp]"
{
"mcpServers": {
"mcp-api-connect": { "command": "/path/to/.venv/bin/mcp-api-connect" }
}
}
Exposes tools: invoke (stateless, one-off), register_connector,
list_connectors, invoke_connector (by name), delete_connector. An agent
can register a connector for "the Salesforce API" once, then just say "call
it with this payload" from then on.
➜ Full setup for Claude Desktop / Claude Code / Cursor, persistence, security notes, and a worked example: docs/mcp-integration.md.
Target — base URL, protocol (rest | soap), timeout, default headers.AuthSpec — type (none, api_key, basic, bearer,
oauth2_client_credentials) + a config dict shaped for that type. OAuth2
tokens are fetched and cached automatically.RequestFormat / ResponseFormat — content type (json, xml,
soap) plus a declarative field_map ({"target.path": "$.source.jsonpath"})
for reshaping payloads without writing code, or a Jinja2 body_template
for full control (required for SOAP envelopes).InvokeSpec — bundles the three above; the unit of "how to reach one
service." Store it as a named Connector or pass it inline per call.See src/mcp_api_connect/core/models.py for the
full schema, and docs/auth-reference.md for the
config shape each auth type expects.
config fields for
every auth typeAuthStrategy, register via
engine.register_auth_strategy(...).ProtocolAdapter, register via
engine.register_adapter(...).ConnectorStore (ships with
InMemoryConnectorStore and SqliteConnectorStore, credentials encrypted
at rest via Fernet).zeep-backed adapter, no hand-written envelope needed)ConnectorStorepython -m venv .venv && source .venv/bin/activate
pip install -e ".[dev,api,storage,mcp]"
pytest
Apache License 2.0 — see LICENSE and NOTICE.
Contributions are accepted under the same license (inbound = outbound); see CONTRIBUTING.md.
mcp-api-connect™ is a trademark of Balaji Venkatasubramaniyar. The Apache 2.0 license covers copyright and patents but grants no trademark rights. You may use the name to refer to this project and to state compatibility, but not to name a fork, product, or service, or to imply endorsement. See TRADEMARKS.md for the full policy.
FAQs
Protocol- and auth-agnostic API connector engine: send one normalized payload, reach REST or SOAP services behind any auth scheme — as a library, HTTP API, or MCP server.
The pypi package mcp-api-connect receives a total of 25 weekly downloads. As such, mcp-api-connect popularity was classified as not popular.
We found that mcp-api-connect demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.