This release is a pre-release and may not be stable for production use.
toolregistry-server
Define custom tools and serve them via OpenAPI or MCP interfaces. Built on ToolRegistry.
Overview
toolregistry-server lets you register Python functions as tools and expose them as services through multiple protocols. It provides:
- Registry Builder: Protocol-agnostic config loading and source registration (
registry_builder) - Protocol Adapters:
OpenAPIAdapter(FastAPI/REST) andMCPAdapter(Model Context Protocol) - App Orchestration:
Appclass for building registries and dispatching to any adapter; subclassprepare_registry()for custom registries - Authentication: Unified Bearer token support (
auth.load_tokens) - CLI:
toolregistry-server openapi/toolregistry-server mcpwith--config,--profile, and more
Ecosystem
| Package | Description | PyPI | TestPyPI | Docs |
|---|---|---|---|---|
| toolregistry | Core library — tool registration, schema generation, execution | Docs | ||
| toolregistry-server | Server adapters — expose tools via OpenAPI & MCP | Docs | ||
| toolregistry-hub | Ready-to-use tools — calculator, web search, file ops, etc. | Docs |
toolregistry (core)
↓
toolregistry-server (tool server)
↓
toolregistry-hub (tool collection + server config)
Installation
# Base (RouteTable, registry_builder, auth)
pip install toolregistry-server
# OpenAPI server (vendored httpserver, no extra needed)
pip install toolregistry-server
# With the ASGI gateway backend (FastAPI + uvicorn)
pip install toolregistry-server[gateway]
# With MCP support
pip install toolregistry-server[mcp]
# With bounded execution of spec-supplied regexes (optional)
pip install toolregistry-server[regex]
# Full
pip install toolregistry-server[all]
The regex extra is not part of all. Without it, spec-supplied
pattern / patternProperties are not executed during request validation;
with it, every match is bounded (50 ms per match, 250 ms per request by
default) and a timeout answers 500. See the OpenAPI guide.
Quick Start
Programmatic — OpenAPI server
from toolregistry import ToolRegistry
from toolregistry_server import RouteTable
from toolregistry_server.adapters.openapi import OpenAPIAdapter
registry = ToolRegistry()
@registry.register
def greet(name: str) -> str:
"""Greet someone by name."""
return f"Hello, {name}!"
route_table = RouteTable(registry)
adapter = OpenAPIAdapter(route_table)
adapter.run(host="0.0.0.0", port=8000)
Programmatic — MCP server
import asyncio
from toolregistry import ToolRegistry
from toolregistry_server import RouteTable
from toolregistry_server.adapters.mcp import MCPAdapter
registry = ToolRegistry()
# ... register tools ...
route_table = RouteTable(registry)
adapter = MCPAdapter(route_table)
adapter.run(transport="stdio") # blocking
# or: asyncio.run(adapter.run_async(transport="sse", host="0.0.0.0", port=8000))
High-level — App class
from toolregistry_server.app import App
# From a config file
App().serve_openapi(config_path="tools.yaml", host="0.0.0.0", port=8000)
App().serve_mcp(config_path="tools.yaml", transport="stdio")
# From a pre-built registry
from toolregistry import ToolRegistry
registry = ToolRegistry()
# ... register tools ...
App().serve_openapi(registry=registry, port=9000)
Custom App subclass
Override prepare_registry to add built-in tools, hooks, or metadata:
from toolregistry_server.app import App
class MyApp(App):
def prepare_registry(self, **kwargs):
from toolregistry import ToolRegistry
registry = ToolRegistry()
registry.register(my_builtin_tool)
# optionally apply user config on top
if kwargs.get("config_path"):
from toolregistry_server import apply_config, load_config
apply_config(registry, load_config(kwargs["config_path"]))
return registry
MyApp().serve_openapi(host="0.0.0.0", port=8000)
CLI
# OpenAPI server from config file
toolregistry-server openapi --config tools.yaml --port 8000
# MCP server (stdio)
toolregistry-server mcp --config tools.yaml --transport stdio
# MCP server (SSE)
toolregistry-server mcp --config tools.yaml --transport sse --port 8000
# With deployment profile (disables network/filesystem tools)
toolregistry-server openapi --config tools.yaml --profile remote
# With Bearer token auth
toolregistry-server openapi --config tools.yaml --tokens /path/to/tokens.txt
Config File
JSONC and YAML are both supported. Three source types: python, mcp, openapi.
mode: denylist # or "allowlist"
disabled: [] # namespaces to exclude (denylist mode)
tools:
# Python module — all public functions
- type: python
module: my_package.tools
namespace: my_tools
# Python class
- type: python
class: my_package.Calculator
namespace: calculator
# MCP server (stdio subprocess)
- type: mcp
transport: stdio
command: ["python", "-m", "my_mcp_server"]
namespace: mcp_tools
# MCP server (SSE / streamable-http)
- type: mcp
transport: http
url: http://localhost:8080/mcp
namespace: remote_mcp
# OpenAPI endpoint
- type: openapi
url: https://api.example.com/openapi.json
namespace: external_api
auth:
type: bearer
token_env: EXTERNAL_API_TOKEN
See examples/config.yaml and examples/config.jsonc for full examples.
Architecture
┌─────────────────────────────────────────────────────────────┐
│ registry_builder │
│ load_config · apply_config · register_*_source │
│ apply_profile · PROFILE_DISABLE_TAGS │
└─────────────────────────┬───────────────────────────────────┘
│
▼
┌─────────────────────────────────────────────────────────────┐
│ RouteTable │
│ (central routing layer) │
└─────────────────────────┬───────────────────────────────────┘
│
┌───────────────┼───────────────┐
▼ ▼ ▼
┌─────────────────┐ ┌─────────────────┐ ┌─────────────────┐
│ OpenAPIAdapter │ │ MCPAdapter │ │ (your adapter) │
│ (FastAPI) │ │ stdio/sse/http │ │ Adapter ABC │
└─────────────────┘ └─────────────────┘ └─────────────────┘
│ │
▼ ▼
┌─────────────────┐ ┌─────────────────┐
│ HTTP Clients │ │ MCP Clients │
└─────────────────┘ └─────────────────┘
Adding a New Adapter
- Subclass
Adapterfromtoolregistry_server.adapters - Implement
run(**kwargs)andcreate_and_run(cls, route_table, **kwargs) - Optionally implement
add_cli_arguments(parser)for CLI integration - Call
App().serve(MyAdapter, ...)— no changes toAppneeded
Deployment Profiles
--profile applies tag-based tool filtering at startup:
| Profile | Disables |
|---|---|
remote |
FILE_SYSTEM, DESTRUCTIVE, PRIVILEGED tagged tools |
local |
NETWORK tagged tools |
Documentation
- Full Documentation
- Configuration Guide
- Authentication & OAuth
- Deploying with an External Authorization Server
- Connecting OAuth Clients
- OAuth Reference
- API Reference
Contributing
Contributions are welcome! Please see our Contributing Guide for details.
License
MIT — see LICENSE.
Related Projects
- ToolRegistry — Core library
- toolregistry-hub — Built-in tool collection
- Model Context Protocol — MCP specification
Metadata
Release files for toolregistry-server 0.10.0.dev0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | Actions |
|---|---|---|---|---|
| toolregistry_server-0.10.0.dev0.tar.gz | 471.3 kB | With provenance | Details for toolregistry_server-0.10.0.dev0.tar.gz |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Actions Reset |
|---|---|---|---|---|
| toolregistry_server-0.10.0.dev0-py3-none-any.whl | Python 3 | none | any | Details for toolregistry_server-0.10.0.dev0-py3-none-any.whl |
Total release size: 806.8 kB
Release files / toolregistry_server-0.10.0.dev0.tar.gz
| Download URL | toolregistry_server-0.10.0.dev0.tar.gz |
|---|---|
| Size | 471.3 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
149895f17a80e7919c7c5b6eecd7b94377c26f4addaf08302ea445fb3e665fb1
|
|
BLAKE2b-256 checksum How to use checksums |
083ed43ddd07080946213d3d673db1880ab8982ce7012bf2eecd5a80e944fae6
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.16
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Nov 10, 2026.
Transparency logRelease files / toolregistry_server-0.10.0.dev0-py3-none-any.whl
| Download URL | toolregistry_server-0.10.0.dev0-py3-none-any.whl |
|---|---|
| Size | 335.5 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
aa68c7a38836231fb27530a6890d7ed8f6a0b0be8e84712af2b4b09494ec6e3d
|
|
BLAKE2b-256 checksum How to use checksums |
279c573e285050b3be7a9a045cfe12d4f25e984730ed110324c1e653ba2cc880
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.16
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Nov 10, 2026.
Transparency logSecurity for toolregistry-server 0.10.0.dev0
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
Full provenance
Both files in this release have been uploaded with provenance metadata.
Attestation for toolregistry_server-0.10.0.dev0.tar.gz
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Nov 10, 2026.
Transparency logA note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.