Swagger GatewayBLOCK
mcp/zaizaizhao/swagger-gateway
MCP Swagger Server 将任何符合 OpenAPI/Swagger 规范的 REST API 转换为 Model Context Protocol (MCP) 格式,让 AI 助手能够理解和调用您的 API。
Verdict
BLOCK
Grade
F
Trust score
49 /100
Exposed tools
15 15r · 0w · 0d
Transport
sse · stdio · streamable-http
License
MIT
Stars
77
01
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://www.typescriptlang.org/) [](https://nodejs.org/) [](LICENSE) [](https://archestra.ai/mcp-catalog/zaizaizhao__mcp-swagger-server)
将 OpenAPI/Swagger 规范转换为 Model Context Protocol (MCP) 格式的工具
零配置将您的 REST API 转换为 AI 可调用的工具
🚀 快速开始 • 📖 使用指南 • 🛠️ 开发
Languages: English | 中文
🎬 快速演示
🎯 项目截图
🎯 项目简介
MCP Swagger Server 是一个将 OpenAPI/Swagger 规范转换为 Model Context Protocol (MCP) 格式的工具。
📦 项目结构
mcp-swagger-server/ ├── packages/ │ ├── mcp-swagger-server/ # 🔧 核心 MCP 服务器 (可用) │ ├── mcp-swagger-parser/ # 📝 OpenAPI 解析器 (可用) │ └── mcp-swagger-api/ # 🔗 REST API 后端 (可用) └── scripts/ # 🔨 构建脚本
✨ 核心特性
- 🔄 零配置转换: 输入 OpenAPI 规范,立即获得 MCP 工具
- 🎯 渐进式命令行: 提供逐步引导的命令行界面,方便用户配置
- 🖥️ 终端优先体验: 以 CLI / 交互式终端作为主要使用方式
- 🔌 多传输协议: 支持 SSE、Streamable 和 Stdio 传输
- 🔐 安全认证: 支持 Bearer Token 认证保护 API 访问
🚀 快速开始
环境要求
- Node.js ≥ 20.0.0
- pnpm ≥ 8.0.0 (推荐)
安装
npm i mcp-swagger-server -g
命令说明
mss:交互式终端界面(默认)mcp-swagger-server/mcp-swagger:标准命令行(适合脚本和 AI 客户端集成)mss --openapi ...:直接启动模式(跳过交互界面)
说明:交互式会话模式下不支持 STDIO 启动;如需 STDIO,请使用mss --openapi ... --transport stdio(兼容别名:mcp-swagger-server --transport stdio ...)。
快速启动
交互式启动(推荐新手)
mss
一键启动(非交互)
mss --openapi https://api.example.com/openapi.json \ --operation-filter-methods GET \ --operation-filter-methods POST \ --transport streamable \ --auth-type bearer \ --bearer-token "your-token-here" # 使用配置文件 mss --config config.jso
Read from source at commit
7df9f5a7fb25OBSERVED · 2026-10-0702
Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude-code
claude mcp add mcp-swagger-server --env DB_PASSWORD=${DB_PASSWORD} --env JWT_REFRESH_SECRET=${JWT_REFRESH_SECRET} --env JWT_SECRET=${JWT_SECRET} -- npx -y [email protected]claude-desktop
{
"mcpServers": {
"mcp-swagger-server": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"DB_PASSWORD": "${DB_PASSWORD}",
"JWT_REFRESH_SECRET": "${JWT_REFRESH_SECRET}",
"JWT_SECRET": "${JWT_SECRET}"
}
}
}
}03
Exposed tools (15)
15 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
ADMIN | read | 管理员,拥有大部分管理权限 |
GUEST | read | 访客,最基本的权限 |
OPERATOR | read | 操作员,拥有基本操作权限 |
SUPER_ADMIN | read | 超级管理员,拥有所有权限 |
VIEWER | read | 查看者,只有查看权限 |
admin | read | 管理员,拥有大部分管理权限 |
guest | read | 访客,最基本的权限 |
id | read | 模板ID |
operator | read | 操作员,拥有基本操作权限 |
permissionId | read | 权限ID |
serverId | read | MCP Server ID |
super_admin | read | 超级管理员,拥有所有权限 |
url | read | URL to the OpenAPI specification |
userId | read | 用户ID |
viewer | read | 查看者,只有查看权限 |
04
Trust audit
BLOCKgrade F · trust 49/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | FAIL |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (8 observation(s))
- Network
- declared (12 observation(s))
- Shell
- declared (6 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
HIGHHard-coded secrets · inv.env_committed · CWE-798, CWE-321
packages/mcp-swagger-api/.env
.env
Why it matters. a real .env in the package
Fix. ship .env.example with placeholders only
HIGHCode injection · code.deserialize · CWE-78, CWE-94, CWE-95
packages/mcp-swagger-server/src/cli/openapi.ts:19
return yaml.load(trimmed);
Why it matters. deserialises untrusted bytes into live objects
Fix. use json or yaml.safe_load
HIGHCode injection · code.deserialize · CWE-78, CWE-94, CWE-95
packages/mcp-swagger-server/src/interactive-cli/index.ts:999
return yaml.load(trimmed);
Why it matters. deserialises untrusted bytes into live objects
Fix. use json or yaml.safe_load
HIGHCode injection · code.deserialize · CWE-78, CWE-94, CWE-95
packages/mcp-swagger-server/src/interactive-cli/utils/server-manager.ts:484
return yaml.load(trimmed);
Why it matters. deserialises untrusted bytes into live objects
Fix. use json or yaml.safe_load
HIGHCode injection · code.deserialize · CWE-78, CWE-94, CWE-95
packages/mcp-swagger-server/src/interactive-cli/wizards/openapi-wizard.ts:813
return yaml.load(trimmed);
Why it matters. deserialises untrusted bytes into live objects
Fix. use json or yaml.safe_load
HIGHNetwork egress · net.tls_off · CWE-200, CWE-319
packages/mcp-swagger-api/src/database/data-source.ts:45
ssl: configService.get('NODE_ENV') === 'production' ? { rejectUnauthorized: false } : false,Why it matters. certificate verification is disabled
Fix. leave verification on
HIGHNetwork egress · net.tls_off · CWE-200, CWE-319
packages/mcp-swagger-api/src/database/database.module.ts:49
? { rejectUnauthorized: false }Why it matters. certificate verification is disabled
Fix. leave verification on
HIGHNetwork egress · net.tls_off · CWE-200, CWE-319
packages/mcp-swagger-parser/src/parsers/url-parser.ts:38
rejectUnauthorized: false
Why it matters. certificate verification is disabled
Fix. leave verification on
MEDIUMInformation disclosure · disclose.log_secret · CWE-209, CWE-532
packages/mcp-swagger-server/src/cli/auth.ts:68
console.log(CliDesign.warning(`环境变量 ${envVar} 未设置,Bearer Token 将在运行时无效`));MEDIUMInformation disclosure · disclose.log_secret · CWE-209, CWE-532
packages/mcp-swagger-server/src/interactive-cli/index.ts:977
console.log(`Token 来源: ${chalk.white(`环境变量 ${authConfig.bearer.envName || 'API_TOKEN'}`)}`);MEDIUMInformation disclosure · disclose.log_secret · CWE-209, CWE-532
packages/mcp-swagger-server/src/interactive-cli/index.ts:979
console.log(`Token 来源: ${chalk.white('静态配置')} ${chalk.gray(authConfig.bearer.token ? '✓ 已配置' : '✗ 未配置')}`);MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
docs/api-authentication-guide.md:69
token: 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...'
LOWInventory / provenance · inv.hidden_file · CWE-1104
packages/mcp-swagger-api/.env
.env
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
packages/mcp-swagger-api/.env.development
.env.development
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
packages/mcp-swagger-api/src/common/interceptors/logging.interceptor.ts:10
import { AppConfigService } from '../../config/app-config.service';LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
packages/mcp-swagger-api/src/modules/config/config.controller.ts:4
import { AppConfigService } from '../../config/app-config.service';LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
packages/mcp-swagger-api/src/modules/config/config.module.ts:4
import { AppConfigService } from '../../config/app-config.service';LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
packages/mcp-swagger-api/src/modules/config/config.module.ts:5
import { validationSchema } from '../../config/validation.schema';LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
packages/mcp-swagger-api/src/modules/core/core.module.ts:3
import { DatabaseModule } from '../../database/database.module';LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
docs/immediate-tasks-week1.md:33
origin: ['http://localhost:3000', 'http://127.0.0.1:3000'],
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
package.json
@changesets/changelog-github, @changesets/cli, @types/node, cross-env, nodemon, rimraf, ts-node, tsconfig-paths
Why it matters. 10 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
packages/mcp-swagger-api/package.json
@modelcontextprotocol/sdk, @nestjs/axios, @nestjs/common, @nestjs/config, @nestjs/core, @nestjs/event-emitter, @nestjs/jwt, @nestjs/passport
Why it matters. 69 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
packages/mcp-swagger-parser/package.json
axios, js-yaml, swagger2openapi, zod, @types/jest, @types/js-yaml, @types/node, @types/swagger2openapi
Why it matters. 13 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
packages/mcp-swagger-server/package.json
@modelcontextprotocol/sdk, @types/figlet, axios, blessed, boxen, chalk, chokidar, cli-table3
Why it matters. 34 dependency range(s) float
Fix. pin exact versions or ship a lockfile
INFOPrompt injection · prompt.credential_read · CWE-94, CWE-1427
README_EN.md:125
--bearer-env Read token from environment variable
Why it matters. asks the agent to read credentials
Gates applied: no_behavioural_pass.
Audited 2026-10-07 · audit v0.4.1 · source sha
7df9f5a7fb25full audit observations/trust-audit/mcp-server/zaizaizhao__swagger-gateway.json · Report an issue / request a re-scan05
Audit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-07 | 7df9f5a7fb25 | BLOCK | F | 49 | first audit |
06
Questions
What is the Swagger Gateway MCP server?
MCP Swagger Server 将任何符合 OpenAPI/Swagger 规范的 REST API 转换为 Model Context Protocol (MCP) 格式,让 AI 助手能够理解和调用您的 API。
What tools does Swagger Gateway expose?
15 in total: 15 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is Swagger Gateway safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (49/100) and found 8 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does Swagger Gateway need?
It reads DB_PASSWORD, JWT_REFRESH_SECRET and JWT_SECRET from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does Swagger Gateway run?
It speaks sse, stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as mcp-swagger-server at 1.7.0.
How current is this page?
The grade is for one exact copy of the source (7df9f5a7fb25), read on 2026-10-07. The repository is watched and re-audited when it changes.