Production-ready library for converting OpenAPI specifications into MCP tool definitions
{
"mcpServers": {
"mcp-from-openapi": {
"args": [
"-y",
"mcp-from-openapi"
],
"command": "npx"
}
}
}Are you the author?
Add this badge to your README to show your security score and help users find safe servers.
Production-ready library for converting OpenAPI specifications into MCP tool definitions
Is it safe?
No known CVEs for mcp-from-openapi. 1 previously resolved.
No authentication — any process on your machine can connect.
License not specified.
Is it maintained?
Last commit 0 days ago. 143 stars. 8,672 weekly downloads.
Will it work with my client?
Transport: stdio, sse, http. Works with Claude Desktop, Cursor, Claude Code, and most MCP clients.
Run this in your terminal to verify the server starts. Then let us know if it worked — your result helps other developers.
npx -y 'mcp-from-openapi' 2>&1 | head -1 && echo "✓ Server started successfully"
After testing, let us know if it worked:
No open vulnerabilities. 1 fixed CVE.
This server is missing a description. Tools and install config are also missing.If you've used it, help the community.
Add informationCVE-2026-39885Fixedmcp-from-openapi is Vulnerable to SSRF via $ref Dereferencing in Untrusted OpenAPI Specifications
## Summary The `mcp-from-openapi` library uses `@apidevtools/json-schema-ref-parser` to dereference `$ref` pointers in OpenAPI specifications without configuring any URL restrictions or custom resolvers. A malicious OpenAPI specification containing `$ref` values pointing to internal network addresses, cloud metadata endpoints, or local files will cause the library to fetch those resources during the `initialize()` call. This enables Server-Side Request Forgery (SSRF) and local file read attacks
Have you used this server?
Share your experience — it helps other developers decide.
Sign in to write a review.
XcodeBuildMCP provides tools for Xcode project management, simulator management, and app utilities.
An open-source AI agent that brings the power of Gemini directly into your terminal.
The full-stack TypeScript framework to build, test, and deploy production-ready MCP servers and AI-native apps.
The leading, most token-efficient MCP server for GitHub source code exploration via tree-sitter AST parsing
MCP Security Weekly
Get CVE alerts and security updates for Mcp From Openapi and similar servers.
Start a conversation
Ask a question, share a tip, or report an issue.
Sign in to join the discussion.