Atlas / MCP servers / ivo-toby / OpenAPI

OpenAPIBLOCK

Name: OpenAPI
Author: ivo-toby

mcp/ivo-toby/openapi-1

MCP server by ivo-toby · Audited 2026-10-05

⚑ Report / re-scan Source ↗

MCP Server (Model Context Protocol) for turning OpenAPI specifications into a MCP Resource

Verdict

BLOCK

Grade

Trust score

69 /100

Exposed tools

13 11r · 2w · 0d

Transport

stdio · streamable-http

License

MIT

Stars

297

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](https://smithery.ai/server/@ivo-toby/mcp-openapi-server)

A Model Context Protocol (MCP) server that exposes OpenAPI endpoints as MCP tools, along with optional support for MCP prompts and resources. This server allows Large Language Models to discover and interact with REST APIs defined by OpenAPI specifications through the MCP protocol.

📖 Documentation

User Guide - For users wanting to use this MCP server with Claude Desktop, Cursor, or other MCP clients
Library Usage - For developers creating custom MCP servers using this package as a library
Developer Guide - For contributors and developers working on the codebase
AuthProvider Guide - Detailed authentication patterns and examples

User Guide

This section covers how to use the MCP server as an end user with Claude Desktop, Cursor, or other MCP-compatible tools.

Overview

This MCP server can be used in two ways:

CLI Tool: Use npx @ivotoby/openapi-mcp-server directly with command-line arguments for quick setup
Library: Import and use the OpenAPIServer class in your own Node.js applications for custom implementations

The server supports two transport methods:

Stdio Transport (default): For direct integration with AI systems like Claude Desktop that manage MCP connections through standard input/output.
Streamable HTTP Transport: For connecting to the server over HTTP, allowing web clients and other HTTP-capable systems to use the MCP protocol.

Quick Start for Users

Option 1: Using with Claude Desktop (Stdio Transport)

No need to clone this repository. Simply configure Claude Desktop to use this MCP server:

Locate or create your Claude Desktop configuration file:
On macOS: `~/Library/Application Support/Claude/claudedesktopconfig.jso

Read from source at commit 13513e077f77OBSERVED · 2026-10-05

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add openapi-mcp-server --env BEATPORT_TOKEN=${BEATPORT_TOKEN} --env CLIENT_KEY_PASSPHRASE=${CLIENT_KEY_PASSPHRASE} --env CLIENT_KEY_PATH=${CLIENT_KEY_PATH} --env REJECT_UNAUTHORIZED=${REJECT_UNAUTHORIZED} -- npx -y @ivotoby/[email protected]

claude-desktop

{
  "mcpServers": {
    "openapi-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@ivotoby/[email protected]"
      ],
      "env": {
        "BEATPORT_TOKEN": "${BEATPORT_TOKEN}",
        "CLIENT_KEY_PASSPHRASE": "${CLIENT_KEY_PASSPHRASE}",
        "CLIENT_KEY_PATH": "${CLIENT_KEY_PATH}",
        "REJECT_UNAUTHORIZED": "${REJECT_UNAUTHORIZED}"
      }
    }
  }
}

Exposed tools (13)

11 read · 2 write · 0 destructive.

Tool	Risk	Description
`List-Users`	read	Custom users
`add`	write	Add two numbers
`api-docs`	read	Full API docs
`custom-users`	read	Custom users
`get-api-endpoint-schema`	read	Get the JSON schema for a specified API endpoint
`greet`	read	A greeting prompt
`invoke-api-endpoint`	write	Invoke an API endpoint with provided parameters
`list-api-endpoints`	read	List all available API endpoints
`list-users`	read	Custom users
`name`	read	Person
`other`	read	Sum
`qry-alerts-qry-alerts-pst`	read	Query alerts
`sum`	read	Sum

Trust audit

BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	PASS
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: none-observed
Network: declared (8 observation(s))
Shell: declared (2 observation(s))
Dependencies: not all pinned
Secrets in source: none-found

Findings (15)

HIGHCode injection · code.deserialize · CWE-78, CWE-94, CWE-95

src/content-loader.ts:54

return yaml.load(content) as T

Why it matters. deserialises untrusted bytes into live objects

Fix. use json or yaml.safe_load

HIGHCode injection · code.deserialize · CWE-78, CWE-94, CWE-95

src/openapi-loader.ts:154

const yamlResult = yaml.load(specContent, {

Why it matters. deserialises untrusted bytes into live objects

Fix. use json or yaml.safe_load

LOWInventory / provenance · inv.hidden_file · CWE-1104

.prettierrc.json

.prettierrc.json

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInventory / provenance · inv.hidden_file · CWE-1104

.releaserc

.releaserc

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose