@octri/mcp

An MCP server that turns your API documentation into tools an AI assistant can call. Claude, Cursor, VS Code Copilot, and any other MCP client can search your endpoints, open a guide, pull a ready-to-use SDK snippet in any supported language, and check the changelog for breaking changes, all from the same OpenAPI spec your docs are built from.

Octri turns an OpenAPI spec into a documentation site, client SDKs for ten languages, an MCP server your AI assistant can call, and monitoring for the API behind them. This package is the MCP server. See octri.dev/mcp.

Node 20 or newer. Runs over stdio for a local client, or Streamable HTTP when you host it.

Operation bodies use documented media type. For multipart or binary values, pass files only as bounded inline descriptor: { "filename": "report.csv", "content": "base64...", "contentType": "text/csv" }. Paths and URLs are intentionally unsupported.

Explicit URL-encoded deepObject fields with explode: true use bracketed wire keys, including nested objects and arrays. This covers APIs such as Stripe that mark fields like invoice_settings and tax_id_data as deepObject.

Install

npx -y @octri/mcp

Most clients are configured with that command, so a global install is optional. The Installation section below has the exact config block for each one.

Or install it in one click. VS Code asks for your project ID; Cursor writes YOUR_PROJECT_ID into its mcp.json for you to replace.

Listed in the official MCP Registry as dev.octri/mcp.

Related MCP server: mcp-swagger

Tools

Installation

Claude Desktop

One click: download octri-mcp-<version>.mcpb from the latest release and open it. Claude Desktop installs the server and asks for the project ID and the API's credentials, keeping secrets in the system keychain. No Node install, no config file.

Or by hand: add to ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):

{
  "mcpServers": {
    "my-api-docs": {
      "command": "npx",
      "args": ["@octri/mcp", "--project-id", "YOUR_PROJECT_ID"]
    }
  }
}

Cursor

Add to .cursor/mcp.json in your project root (or ~/.cursor/mcp.json globally):

{
  "mcpServers": {
    "my-api-docs": {
      "command": "npx",
      "args": ["@octri/mcp"],
      "env": {
        "OCTRI_PROJECT_ID": "YOUR_PROJECT_ID"
      }
    }
  }
}

VS Code (Copilot / MCP extension)

Add to .vscode/mcp.json:

{
  "servers": {
    "my-api-docs": {
      "type": "stdio",
      "command": "npx",
      "args": ["@octri/mcp", "--project-id", "YOUR_PROJECT_ID"]
    }
  }
}

Environment variables

* Required unless every tool call passes projectId explicitly.

Credentials for the API being called

Operation tools call your real API, and these supply its credentials:

All of these are sent as HTTP headers. An API that takes its credentials in the request body instead (Plaid's client_id and secret, for example) is not served by them: those are ordinary body fields, so they appear as tool arguments and the agent passes them like any other field. Setting OCTRI_API_KEY for such an API adds a header it ignores.

Permissions

The project owner sets every operation tool to run on its own, ask first, or off, and publishes that from the MCP page. Reads run on their own by default and everything else asks first. An "ask first" call is shown to the user through MCP elicitation (Claude Code 2.1.76+, VS Code) with its method, URL and body, and is sent only on approval. A client that cannot ask is refused the call instead.

These narrow what the owner allowed. Only ALLOW widens anything, and nothing brings back a tool the owner turned off:

Tool groups

A project owner can split the tools into groups, each served as its own MCP server, so a team connects only the tools a job needs. Pass --group <slug> (or set OCTRI_GROUP) to serve one. Inside a group every tool keeps the owner's permissions and the limits above: a group only takes tools away. Each group can also be reached hosted, at https://api.octri.dev/api/v1/public/mcp/<project id>/g/<group>/mcp.

Usage reporting

Each tool call reports its tool name, outcome, duration, tool group (when one is served) and the client's name to Octri, so the project owner can see which tools agents use. Arguments and responses are never sent. Set OCTRI_TELEMETRY=0 or pass --no-telemetry to turn it off.

Remote hosting

Use Streamable HTTP (MCP_TRANSPORT=http), the transport the MCP spec has defined for remote servers since revision 2025-03-26 and the one a current client tries first:

docker build -t octri-mcp .

docker run -p 3000:3000 \
  -e MCP_AUTH_TOKEN=<a long random token> \
  -e OCTRI_PROJECT_ID=YOUR_PROJECT_ID \
  octri-mcp

The image binds all interfaces, so it refuses to start without MCP_AUTH_TOKEN; clients send it as Authorization: Bearer <token>. It runs as a non-root user, and GET /health answers a container or load balancer probe without the token.

It serves a single endpoint, /mcp. A client's first request opens a session and gets its id back in the mcp-session-id header; every later request carries it and reaches the same server. That is what lets a tool that asks first work: the approval prompt goes out in the middle of a call and the answer comes back on another request. Sessions idle for 30 minutes are closed. Behind more than one replica, route by mcp-session-id (sticky sessions). Point a remote MCP client at http://your-host:3000/mcp.

Legacy HTTP+SSE transport

MCP_TRANSPORT=sse serves the older 2024-11-05 design, kept so existing deployments keep working. It exposes GET /sse to open a connection and POST /messages?sessionId=<id> to relay client messages. Prefer http for anything new.

Binding and origins

Both HTTP transports bind 127.0.0.1 by default and refuse any request whose Origin is not listed in MCP_ALLOWED_ORIGINS, or whose Host is not loopback. This server holds your API credentials, and any page the browser visits can reach a loopback port.

Widening MCP_HOST puts those credentials on the network, so the server then refuses to start without MCP_AUTH_TOKEN, and every request must send Authorization: Bearer <token>. Configure the same header in your MCP client, and list browser origins explicitly.

Check your setup

npx -y @octri/mcp doctor --project-id YOUR_PROJECT_ID

Confirms the project and its tools load, the base URL and credentials are set, and makes one real read call, then says what to fix if anything fails. --no-call skips the call. Exits non-zero on a failure.

Keep the credential out of the config

npx -y @octri/mcp login --project-id YOUR_PROJECT_ID

Asks for the API credential the project's scheme needs and saves it in your system keychain (macOS Keychain, Windows Credential Manager, or the Secret Service on Linux). Your MCP client's config then needs no OCTRI_API_* variable. A variable set in the config still wins. logout removes it.

The keychain store, @napi-rs/keyring, is an optional dependency. Where it cannot install or the system has no secret store, login says so and env variables work as before.

Local development

# Build
pnpm build

# Run in stdio mode
OCTRI_PROJECT_ID=my-project node dist/index.js

# Run in Streamable HTTP mode (POST /mcp)
MCP_TRANSPORT=http OCTRI_PROJECT_ID=my-project node dist/index.js

# Run in the legacy SSE mode
MCP_TRANSPORT=sse OCTRI_PROJECT_ID=my-project node dist/index.js

As a library

The octri-mcp command is one host for the server core. createServer takes the tool source and everything else a host decides:

import { createServer, startStdio, processEnv, loadUserPermissions } from "@octri/mcp";

const env = processEnv("ACME"); // reads ACME_API_TOKEN, ACME_ALLOW_TOOLS, ...
await startStdio(() =>
  createServer({
    // "live" fetches tools from the Octri API; "static" serves a fixed manifest.
    source: { kind: "static", manifest },
    branding: { name: "acme-mcp", version: "2.4.0" },
    env,
    permissions: loadUserPermissions(process.argv.slice(2), env),
  }),
);

A static source serves Octri's documentation tools, and reports usage, only when it is given an Octri project (octri: { apiUrl, projectId }).

Publishing

pnpm build
pnpm pack:mcpb
npm publish --access public
gh release upload v<version> octri-mcp-<version>.mcpb --repo octridev/octri-mcp
mcp-publisher publish

Requires an npm account with access to the @octri scope. pack:mcpb writes the MCP Bundle and points server.json at it on the GitHub release, so upload that exact file before mcp-publisher publish.

The rest of Octri

Monitoring runtimes

Node · Python · Go · Ruby · Rust · PHP · Java · Kotlin · Swift · Dart

Documentation · Pricing · Changelog

MIT licensed.