Yanked

This release has been yanked by its maintainers, and will be ignored by installers, except when explicitly specified.
Consider using release 0.4.0 instead.
Reason given by maintainers: Broken: installs mcp 2.x, so generated servers fail to start, and codebase generation is refused by the API since 0.4.0. Please upgrade: pip install -U vulcai-mcp-forge-cli

vulcai-mcp-forge-cli

Turn any system into a production-ready MCP server — APIs, legacy codebases, CLI tools, internal docs.

pip install vulcai-mcp-forge-cli
mcp-forge run https://petstore3.swagger.io/api/v3/openapi.json

Why mcp-forge:

23 languages including COBOL, Fortran, R, Julia — the only generator that works on real legacy codebases
Built-in quality scoring — every generated server is automatically evaluated on 6 criteria (structure, coverage, auth, docs, fidelity, robustness) with a 0–10 score
Security-first — the CLI runs on your machine; your source code and credentials never leave your infrastructure
Agents included — the public MCP server at mcp.mcp-forge.vulcai.io exposes high-level tools so AI agents can generate servers without any pre-parsing

Use directly with AI agents

Connect Claude, Cursor or any MCP client to the mcp-forge public server:

https://mcp.mcp-forge.vulcai.io/sse

Available tools (no pre-parsing required — just pass a URL):

Tool	What it does
`generate_from_openapi(spec_url)`	Parse an OpenAPI/Swagger spec and generate a server
`generate_from_graphql(endpoint_url)`	Introspect a GraphQL endpoint and generate a server
`generate_from_website(url)`	Analyze HTML/JS patterns on a page and generate a server
`generate_async(source_type, base_url)`	Advanced: submit a job with a pre-built payload
`get_job_status(job_id)`	Check status of a running generation

For codebase analysis, CLI tool wrapping, or any source not publicly accessible via HTTPS, use the CLI tool — source code and credentials stay on your machine.

How it compares

mcp-forge focuses on production-grade MCP servers for legacy and enterprise use cases. Here's how it compares to other MCP generators:

Feature	mcp-forge	FastMCP	Smithery	openapi-mcp-generator
OpenAPI → MCP	✅	✅	✅	✅
GraphQL → MCP	✅	❌	Partial	❌
Codebase → MCP (23 languages incl. COBOL, Fortran)	✅	❌	❌	❌
CLI tool → MCP (via local CLI)	✅	❌	❌	❌
Website → MCP	✅	❌	❌	❌
Automatic quality scoring (0–10 on 6 criteria)	✅	❌	❌	❌
OAuth 2.0 with PKCE in generated servers	✅	❌	❌	❌
Rate limiting in generated servers	✅	❌	❌	❌
Async job pattern for long generations	✅	❌	❌	❌
On-premise deployment	✅	N/A	❌	N/A
Source code stays on user's machine (via CLI)	✅	N/A	❌	✅
License model	Freemium + commercial	MIT	Freemium	MIT
CLI open source	✅ (MIT)	✅	N/A	✅
Backend open source	❌	✅	❌	✅

If you're wrapping a simple public OpenAPI and want a minimal dependency, FastMCP or openapi-mcp-generator may be a better fit. If you need multi-language codebase support, quality scoring, OAuth, or on-premise deployment, mcp-forge is designed for that.

What it does

mcp-forge analyses your source, extracts all callable operations, optionally enriches them with an LLM, and writes a fully working MCP server (server.py + requirements.txt) ready to plug into Claude Desktop, Claude Code, Cursor, VS Code or any MCP-compatible client.

Every generated server includes OAuth 2.0 (Authorization Code + PKCE), rate limiting, multi-tenant token isolation, and SSE transport — out of the box.

Every generated server is automatically evaluated on 6 quality criteria. The eval_score (0–10) and detailed report are included in the generation response.

Automatic quality evaluation

Every generated server is scored by an LLM on 6 criteria immediately after generation:

Criterion	What is checked
Code structure	Readability, organisation, FastMCP idioms
Endpoint coverage	All tools present and correctly mapped
Auth & security	Env vars, headers, no hardcoded secrets
Description quality	Docstrings, tool names, argument documentation
Spec fidelity	Types, body vs query params, path parameters
Robustness	Timeout handling, error handling, default values

Each criterion is scored 0–10. The global score and full report are included in the generation response (eval_score, eval_report). Servers scoring below 6/10 are automatically refined before delivery.

Run the evaluator manually on any server:

mcp-forge evaluate output/my_server/server.py

Supported sources

Source	Auto-detected when	Example
OpenAPI / Swagger	URL or file ending in `.json`, `.yaml`, `.yml`	`mcp-forge run https://api.example.com/openapi.json`
GraphQL	URL contains `graphql` or ends with `/graphql`	`mcp-forge run https://api.example.com/graphql`
Codebase	Local directory path	`mcp-forge run ./my-project`
CLI application	Command name (no slashes, no http)	`mcp-forge run git`
Website	`http://` or `https://` URL without spec extension	`mcp-forge run https://example.com`

Supported languages for codebase analysis: Python, JavaScript, TypeScript, Go, Rust, Java, C/C++, C#, PHP, Ruby, Kotlin, Swift, Scala, Dart, Elixir, R, Fortran, Bash, PowerShell, Groovy, Julia, Lua, COBOL.

Installation

Requirements: Python 3.11+ · Node.js 18+ · uv

pip install vulcai-mcp-forge-cli

Install uv (used to run generated servers):

# Windows (PowerShell)
powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex"

# macOS / Linux
curl -LsSf https://astral.sh/uv/install.sh | sh

Website scraping support (JS-heavy pages / SPAs — requires Playwright):

pip install "vulcai-mcp-forge-cli[web]"
playwright install chromium

License key

Get your license key at mcp-forge.vulcai.io then register it once in your project directory:

mcp-forge set-license mfg_live_...

This saves the key to a .env file and it will be picked up automatically on every mcp-forge run call.

Quick start

# OpenAPI from URL
mcp-forge run https://petstore3.swagger.io/api/v3/openapi.json

# GraphQL
mcp-forge run https://countries.trevorblades.com/graphql

# Local codebase
mcp-forge run ./my-python-project

# CLI tool
mcp-forge run git

# Website
mcp-forge run https://docs.example.com

# Custom output and server name
mcp-forge run https://api.example.com/openapi.json --output ~/mcp-servers --name my_api

The generated server is written to mcp-forge-output/<server_name>/ by default.

CLI reference

`mcp-forge run <source>`

Option	Values	Description
`--mode, -m`	`auto` · `semi` · `guided`	Generation mode — auto runs silently, semi prompts on ambiguity, guided is fully interactive
`--type, -t`	`openapi` · `graphql` · `codebase` · `cli_app` · `website`	Force source type instead of auto-detect
`--output, -o`	`<path>`	Output directory (default: `mcp-forge-output/`)
`--name, -n`	`<string>`	Override the generated server name
`--name-style, -ns`	`short` · `exhaustive`	Tool naming style
`--api-key`	`<string>`	Anthropic API key (overrides `ANTHROPIC_API_KEY`)
`--local`	flag	Force local pipeline — no call to the Vulcai API
`--no-llm`	flag	Skip LLM enrichment — generate from raw discovery only
`--config, -c`	`<file.yaml>`	Load options from a YAML config file (default: `mcp-forge.yaml` if present)
`--smoke-test`	flag	Run a smoke test automatically after generation
`--functional-test`	flag	Start the server and run a full MCP functional test after generation

`mcp-forge set-license <key>`

Save your license key to .env in the current directory.

mcp-forge set-license mfg_live_abc123...

`mcp-forge test <server.py>`

Launch MCP Inspector on a generated server. Opens in your browser. Accepts Windows backslash paths.

mcp-forge test output/my_server/server.py

`mcp-forge smoke-test <server_dir>`

Validate a generated server without starting it. Checks: server.py present, Python syntax valid, importable, mcp object present, at least 1 @mcp.tool registered, VERSION file consistency.

mcp-forge smoke-test output/my_server

`mcp-forge functional-test <server_dir>`

Start the server and communicate with it via JSON-RPC / stdio — exactly like a real MCP client. Verifies: server starts, MCP handshake succeeds, tools/list returns ≥1 tool, count matches VERSION file.

Option	Description
`--timeout, -t`	Max wait time per phase in seconds (default: 15)

mcp-forge functional-test output/my_server --timeout 30

`mcp-forge evaluate <server.py>`

Evaluate the quality of a generated server using LLM analysis. Produces a detailed quality report.

Option	Description
`--context, -C <string>`	Additional context — source spec, use case, expected behaviour
`--json`	Output raw JSON (useful for CI/CD pipelines)
`--save, -s <file.json>`	Save the JSON report to a file
`--api-key <string>`	Anthropic API key (overrides `ANTHROPIC_API_KEY`)

mcp-forge evaluate output/my_server/server.py --context "Petstore API" --save report.json

`mcp-forge list`

List all generated MCP servers in the output directory. Displays name, generation date, source and tool count.

Option	Description
`--output, -o <path>`	Directory to inspect (default: `mcp-forge-output/`)

mcp-forge list

`mcp-forge info`

Display version info, supported source types and current configuration.

`mcp-forge --version`

Print the installed version and exit.

Generation modes

Mode	Description
`auto`	Fully automatic — no prompts
`semi`	Pauses on ambiguity, interactive where needed
`guided`	Step-by-step with full control over every tool

LLM enrichment

By default, mcp-forge calls the Vulcai API to enrich tool names and descriptions using Claude. Set your license key with mcp-forge set-license — no Anthropic key needed in cloud mode.

To run fully locally (requires [engine] extras — not publicly distributed):

mcp-forge run https://api.example.com/openapi.json --local

To skip enrichment entirely:

mcp-forge run https://api.example.com/openapi.json --no-llm

Configuration file

Create mcp-forge.yaml in your project root:

source: https://api.example.com/openapi.json
mode: auto
output: ../mcp-servers
name: my-api-server
name_style: short
no_llm: false
functional_test: true

CLI flags always override the config file. Use a custom path with --config path/to/config.yaml.

Environment variables

Variable	Description
`FORGE_LICENSE_KEY`	Your mcp-forge license key. Set automatically by `mcp-forge set-license`.
`FORGE_API_URL`	Override the Vulcai API endpoint — useful for on-premise deployments.
`FORGE_MODE`	Set to `local` to always use the local pipeline.
`ANTHROPIC_API_KEY`	Anthropic API key — only needed when running the local pipeline with LLM enrichment.

Connecting to AI clients

Claude Desktop

Edit ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):

{
  "mcpServers": {
    "my_api": {
      "command": "uv",
      "args": ["run", "--with", "mcp", "mcp", "run", "server.py"],
      "cwd": "./mcp-forge-output/my_api"
    }
  }
}

Restart Claude Desktop — your tools appear automatically.

Claude Code (CLI)

claude mcp add my_api uv -- run --with mcp mcp run server.py \
  --cwd ./mcp-forge-output/my_api

Cursor

Open Settings › MCP › Add new global MCP server:

{
  "my_api": {
    "command": "uv",
    "args": ["run", "--with", "mcp", "mcp", "run", "server.py"],
    "cwd": "./mcp-forge-output/my_api"
  }
}

VS Code (Copilot / Continue)

In .vscode/mcp.json:

{
  "servers": {
    "my_api": {
      "type": "stdio",
      "command": "uv",
      "args": ["run", "--with", "mcp", "mcp", "run", "server.py"],
      "cwd": "./mcp-forge-output/my_api"
    }
  }
}

Windsurf

Open Settings › Cascade › MCP servers › Add Server:

{
  "my_api": {
    "command": "uv",
    "args": ["run", "--with", "mcp", "mcp", "run", "server.py"],
    "cwd": "./mcp-forge-output/my_api"
  }
}

Generic (any MCP-compatible client)

All clients implementing the MCP spec accept a STDIO transport:

command : uv
args    : run --with mcp mcp run server.py
cwd     : ./mcp-forge-output/<server_name>
env     : { "MY_API_KEY": "..." }   ← optional, for authenticated APIs

Authenticated APIs: if your API requires credentials, set them in the env block. The generated server.py reads credentials from environment variables — no secrets are hardcoded.

CI/CD integration

- name: Generate MCP server
  run: |
    pip install vulcai-mcp-forge-cli
    mcp-forge run https://api.example.com/openapi.json --mode auto --no-llm
    mcp-forge smoke-test mcp-forge-output/my_api

Security & Compliance

For data retention, LLM access policies, GDPR compliance, and subprocessors, see the Trust & Security page.

License

MIT — see LICENSE.

Metadata

Release files for vulcai-mcp-forge-cli 0.2.10

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Built distribution (wheel)

Table of built distributions (wheels) for vulcai-mcp-forge-cli 0.2.10
File	Interpreter	ABI	Platform	Actions Reset
vulcai_mcp_forge_cli-0.2.10-py3-none-any.whl 137.9 kB Sep 24, 2026 Without provenance	Python 3	none	any	Details for vulcai_mcp_forge_cli-0.2.10-py3-none-any.whl

Release files / vulcai_mcp_forge_cli-0.2.10-py3-none-any.whl

Download URL	vulcai_mcp_forge_cli-0.2.10-py3-none-any.whl
Size	137.9 kB
Tags	Python 3
SHA-256 checksum How to use checksums	`130c2498f07bba82102578d4a4ef733491fb682dc53358986496bd9f18e1fe41`
BLAKE2b-256 checksum How to use checksums	`a4590fc6ab9cb4a492cb91cd7c84cfd6388ae51ae7ad96054df1bd0b196b64ae`
Upload date	Sep 24, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	No
Uploaded via	`uv/0.12.18 {"installer":{"name":"uv","version":"0.12.18","subcommand":["publish"]},"python":null,"implementation":{"name":null,"version":null},"distro":{"name":"Ubuntu","version":"24.04","id":"noble","libc":null},"system":{"name":null,"release":null},"cpu":null,"openssl_version":null,"setuptools_version":null,"rustc_version":null,"ci":true}`

Security for vulcai-mcp-forge-cli 0.2.10

Report project as malware

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

No provenance found

None of the files in this release were uploaded with provenance metadata.

A note on package security

PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.

To learn more about protecting yourself from malicious actors, visit our package security documentation.

Release history Release notifications | RSS feed

Yanked

0.2.10 This release

Sep 24, 2026 1 release file No provenance