openapi-mcp-bridge
Turn any OpenAPI/Swagger API into Model Context Protocol tools. Point the bridge at a spec (URL or local file) and every endpoint becomes an MCP tool that an AI assistant — Claude Desktop, or any MCP client — can call directly. The bridge constructs the real HTTP request, sends it, and returns the response to the model.
- 🔧 One tool per endpoint — names from
operationId, JSON Schema inputs built from parameters and request bodies. - 📥 OpenAPI 3.x and Swagger 2.0 — both normalised to the same model.
- 🔌 stdio transport built on the official
mcpSDK. - 🔒 No secrets in code — every credential comes from an environment variable.
- ✅ Typed, tested, and linted.
Installation
pip install openapi-mcp-bridge
Or install it as an isolated CLI tool:
pipx install openapi-mcp-bridge
It requires Python 3.10+.
Quickstart
List the tools generated from the public Swagger Petstore spec (this does not start a server — handy for inspecting what will be exposed):
openapi-mcp-bridge --spec https://petstore3.swagger.io/api/v3/openapi.json --list-tools
Run it as an MCP server over stdio:
openapi-mcp-bridge --spec https://petstore3.swagger.io/api/v3/openapi.json
You can also invoke it as a module:
python -m openapi_mcp_bridge --spec ./openapi.yaml
Use with Claude Desktop
Add an entry to your claude_desktop_config.json:
- macOS:
~/Library/Application Support/Claude/claude_desktop_config.json - Windows:
%APPDATA%\Claude\claude_desktop_config.json
{
"mcpServers": {
"petstore": {
"command": "openapi-mcp-bridge",
"args": ["--spec", "https://petstore3.swagger.io/api/v3/openapi.json"],
"env": {
"OPENAPI_MCP_TOKEN": "your-bearer-token-here"
}
}
}
}
If you do not have the console script on your PATH, you can run it with
uv without installing anything:
{
"mcpServers": {
"petstore": {
"command": "uvx",
"args": [
"openapi-mcp-bridge",
"--spec",
"https://petstore3.swagger.io/api/v3/openapi.json"
]
}
}
}
Restart Claude Desktop after editing the config. The same command/args/env
shape works for any MCP client (e.g. Cursor, Continue, or a custom one).
Command-line options
| Option | Description |
|---|---|
--spec (required) |
OpenAPI/Swagger spec to load: an http(s) URL or a file path. |
--base-url |
Override the API server base URL declared in the spec. |
--name |
MCP server name (defaults to the spec's info.title). |
--timeout |
Per-request HTTP timeout in seconds (default 30). |
--list-tools |
Print the generated tools and exit without starting the server. |
--version |
Print the version and exit. |
Configuration & authentication
Credentials and connection settings are read from environment variables. No secret is ever stored in code or in the spec.
| Variable | Purpose |
|---|---|
OPENAPI_MCP_BASE_URL |
Override the API base URL (same as --base-url). |
OPENAPI_MCP_TOKEN |
Bearer token → Authorization: Bearer <token>. |
OPENAPI_MCP_API_KEY |
Secret for an apiKey scheme; the header/query name and location are taken from the spec (default header X-API-Key). |
OPENAPI_MCP_BASIC_USERNAME / OPENAPI_MCP_BASIC_PASSWORD |
HTTP Basic credentials. |
OPENAPI_MCP_EXTRA_HEADERS |
JSON object of extra headers merged into every request; overrides derived auth headers. |
OPENAPI_MCP_TIMEOUT |
Per-request timeout in seconds (same as --timeout). |
OPENAPI_MCP_VERIFY_TLS |
Set to false/0/no to disable TLS verification (not recommended). |
A bearer token takes priority over basic credentials. Need a custom auth header
the spec doesn't describe? Use OPENAPI_MCP_EXTRA_HEADERS, e.g.
{"X-Custom-Auth": "value"}.
How it works
- Load the spec from a URL or file (JSON or YAML) and resolve intra-document
$refpointers, with cycle protection. - Normalise OpenAPI 3.x / Swagger 2.0 into a single internal model of operations, parameters, request bodies, and security schemes.
- Generate one MCP tool per operation. Path/query/header parameters become
top-level JSON Schema properties; the request body becomes a
bodyproperty. - Proxy each tool call to a real HTTP request — substituting path parameters, attaching the query string, injecting auth, and sending the body — then return the status line and response body to the model.
Development
git clone https://github.com/sssdavid529/openapi-mcp-bridge.git
cd openapi-mcp-bridge
python -m venv .venv && pip install -e ".[dev]"
ruff check . && ruff format --check . && pytest
See CONTRIBUTING.md for more.
License
Metadata
Release files for openapi-mcp-bridge 0.2.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | |
|---|---|---|---|---|
| openapi_mcp_bridge-0.2.0.tar.gz | 24.5 kB | With provenance | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| openapi_mcp_bridge-0.2.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 46.7 kB
Release files / openapi_mcp_bridge-0.2.0.tar.gz
| Download URL | openapi_mcp_bridge-0.2.0.tar.gz |
|---|---|
| Size | 24.5 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
6697520c4b193b3b58e95d72bc57332799728d495303df1fca358927621d4792
|
|
BLAKE2b-256 checksum How to use checksums |
8792a403f2c50fdfee872478fd4013f84a8ee9a474aa2cf51560fcca72543f7a
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.12
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on May 31, 2026.
Transparency logRelease files / openapi_mcp_bridge-0.2.0-py3-none-any.whl
| Download URL | openapi_mcp_bridge-0.2.0-py3-none-any.whl |
|---|---|
| Size | 22.2 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
d6f9bbac5ba6aecd7232b5f1e4d305ec3252015f6d34715e0ee9686c9e00a0bf
|
|
BLAKE2b-256 checksum How to use checksums |
0907b9b80051ec710d3866b88b058f40212debab60f620b948e47d9866b8c6d1
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.12
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on May 31, 2026.
Transparency logSecurity for openapi-mcp-bridge 0.2.0
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
Full provenance
All 2 files in this release have been uploaded with provenance metadata.
Attestation for openapi_mcp_bridge-0.2.0.tar.gz
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on May 31, 2026.
Transparency logA note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.