MyMCP

Turns any OpenAPI description into an MCP server. Point it at a description URL and every operation becomes a tool an AI client can call, with no server to write and nothing to deploy.

Hosted at mymcp.gmitch215.xyz. Runs on Cloudflare Workers, so you can also deploy your own.

https://mymcp.gmitch215.xyz/{server}/mcp

{server} is either a preconfigured alias or a URL-encoded link to an OpenAPI description.

# preconfigured alias
https://mymcp.gmitch215.xyz/petstore/mcp

# a hostname, which is checked for a description
https://mymcp.gmitch215.xyz/api.tabroom.com/mcp

# a full description URL, percent-encoded
https://mymcp.gmitch215.xyz/https%3A%2F%2Fapi.example.com%2Fopenapi.json/mcp

How It Works

MyMCP fetches the description, resolves its schemas, and builds one MCP tool per operation. Path, query, header and cookie parameters keep the names the API gives them; a binding table records where each one belongs on the wire, so nothing has to be inferred from an argument name at call time.

When the URL does not serve a description directly, MyMCP looks for one. It reads Link: rel="service-desc" headers, then the configuration embedded by Scalar, Swagger UI, Redoc, Stoplight Elements and RapiDoc, then a list of well-known paths. Pointing at api.tabroom.com finds the description at /v1 without being told where it is.

OpenAPI 3.0, 3.1 and Swagger 2.0 are supported, in JSON or YAML.

Related MCP server: OpenAPI MCP Server

Preconfigured Servers

Add more in src/servers.json. bun run servers:check validates every entry, and runs weekly in CI.

Filters

Large APIs produce hundreds of tools, which most clients handle poorly. Narrow the set with query parameters on the connection URL:

https://mymcp.gmitch215.xyz/stripe/mcp?tags=Customers&methods=get&max=40

Filters are part of the cache key, so two differently filtered connections do not share a tool list.

Authentication

Credentials for the upstream API travel in their own headers, never in Authorization:

MyMCP reads the description's securitySchemes and applies the credential where each operation expects it, covering http bearer, http basic, and apiKey in a header, query string or cookie. Any X-Mcp-Upstream-<Header> value that matches no scheme is forwarded as-is, which covers APIs that need headers their own description does not declare.

Credentials go only to hosts the description declares in its servers list, plus anything in ALLOWED_HOSTS. They are dropped on any redirect that leaves those hosts. A description fetched from an arbitrary URL therefore cannot route a credential somewhere of its own choosing.

The MCP specification forbids an MCP server from reusing the client's own credentials against a third-party API. Keeping upstream credentials in a separate header family means the caller is handing MyMCP a key for a named API rather than having an MCP token forwarded on their behalf, and leaves Authorization free for MCP's own authorization. For the flow the specification prefers, where MyMCP holds the upstream tokens itself, see Authorization.

Client Setup

Claude Code

claude mcp add --transport http petstore https://mymcp.gmitch215.xyz/petstore/mcp

# with a credential for the upstream API
claude mcp add --transport http tabroom https://mymcp.gmitch215.xyz/tabroom/mcp \
  --header "X-Mcp-Upstream-Authorization: Bearer $TABROOM_TOKEN"

Or in .mcp.json, which supports ${VAR} expansion:

{
	"mcpServers": {
		"stripe": {
			"type": "http",
			"url": "https://mymcp.gmitch215.xyz/stripe/mcp?tags=Customers",
			"headers": {
				"X-Mcp-Upstream-Authorization": "Bearer ${STRIPE_SECRET_KEY}"
			}
		}
	}
}

Use --scope project to commit the entry for a team, or --scope user to make it global. For credentials that rotate, headersHelper runs a script that prints headers as JSON.

Codex CLI

codex mcp add petstore --url https://mymcp.gmitch215.xyz/petstore/mcp

Or in ~/.codex/config.toml:

[mcp_servers.stripe]
url = "https://mymcp.gmitch215.xyz/stripe/mcp?tags=Customers"
bearer_token_env_var = "MYMCP_TOKEN"
http_headers = { "X-Mcp-Upstream-Authorization" = "Bearer sk_test_..." }
startup_timeout_sec = 20
tool_timeout_sec = 120

bearer_token_env_var sets Authorization, which MyMCP uses for its own authorization. Upstream credentials belong in http_headers.

Gemini CLI

gemini mcp add --transport http petstore https://mymcp.gmitch215.xyz/petstore/mcp

Or in ~/.gemini/settings.json:

{
	"mcpServers": {
		"petstore": {
			"httpUrl": "https://mymcp.gmitch215.xyz/petstore/mcp",
			"headers": {
				"X-Mcp-Upstream-Authorization": "Bearer ${API_TOKEN}"
			}
		}
	}
}

Gemini CLI uses httpUrl for Streamable HTTP and url for the older SSE transport.

Cursor, VS Code and Claude Desktop

All three take the same shape in their MCP configuration file:

{
	"mcpServers": {
		"petstore": {
			"type": "http",
			"url": "https://mymcp.gmitch215.xyz/petstore/mcp",
			"headers": {
				"X-Mcp-Upstream-Authorization": "Bearer ..."
			}
		}
	}
}

Claude Code Plugin

The repository is a plugin marketplace, which installs a set of servers in one step:

/plugin marketplace add gmitch215/MyMCP
/plugin install mymcp@mymcp

The bundled servers read their credentials from TABROOM_TOKEN, DIGITALOCEAN_TOKEN and STRIPE_SECRET_KEY. See plugin/.mcp.json.

Endpoints

POST /{server}/sse is treated as Streamable HTTP so existing configurations keep working.

The SSE transport needs the two halves of a session to share state, which a stateless Worker cannot do alone. Bind the MCP_SSE Durable Object to enable it; without that binding, GET /{server}/sse returns 405 and points at /{server}/mcp.

Protocol Support

Methods: server/discover, initialize, ping, tools/list, tools/call, prompts/list, prompts/get, resources/list, resources/read, resources/templates/list, completion/complete, subscriptions/listen, and tasks/get, tasks/update, tasks/cancel.

On 2026-07-28, MCP-Protocol-Version, Mcp-Method and Mcp-Name are required and validated against the request body; a mismatch returns 400 with error -32020. Set MCP_STRICT_HEADERS=0 to accept requests that omit them.

Elicitation

When a client supports elicitation, MyMCP asks instead of failing:

• A call missing required arguments returns a form requesting them.

• With ?confirm=write, a write operation asks for confirmation before it runs.

• When an operation needs credentials and none were supplied, a URL-mode elicitation starts the upstream sign-in flow.

The state carried between rounds is AEAD-sealed and bound to the caller, the originating request and a short expiry, so it cannot be replayed onto another call.

Tasks

With KV bound, MyMCP implements the io.modelcontextprotocol/tasks extension. An upstream that answers 202 Accepted with a Location header becomes a task; the client polls tasks/get, and MyMCP advances the upstream job on each read. Without KV the extension is not advertised, because a task handle has to outlive the request that created it.

Authorization

MyMCP is open by default. Setting AUTH_PROVIDER turns it into an OAuth 2.1 resource server: it serves RFC 9728 resource metadata, answers unauthenticated requests with 401 and a WWW-Authenticate challenge, and validates that a token's audience is this server.

Three identity providers are supported:

With a provider and KV configured, /connect starts an OAuth flow against the upstream API using the oauth2 scheme its description declares. MyMCP stores the resulting token against the verified user and uses it on their behalf, so upstream credentials never reach the MCP client. The callback checks that the browser user is the same principal that began the flow.

Self-Hosting

git clone https://github.com/gmitch215/MyMCP.git
cd MyMCP
bun install
bun run dev

Deploy with bun run deploy. Everything below is optional; with none of it set, MyMCP runs as a stateless public gateway.

Network Policy

MyMCP fetches URLs a caller supplies, so it refuses anything that is not publicly routable: plain HTTP, loopback, RFC1918, carrier-grade NAT, link-local including 169.254.169.254, multicast, and the IPv6 equivalents including IPv4-mapped forms. The check runs on the description URL, every discovery candidate and each redirect hop.

INSECURE_UPSTREAM_HOSTS exempts specific host:port entries, for an instance deployed alongside a private API. Every entry is a host callers can then reach through the service.

Descriptions and their derived tool tables are cached, and concurrent requests for the same uncached description share one build.

Prompt Injection

Tool names and descriptions come from a third-party document and reach model context verbatim. MyMCP strips control characters, ANSI escapes and zero-width and bidi overrides from that text, caps its length, and states in the server instructions that the descriptions are data rather than instructions.

Development

bun run typecheck
bun run test                # unit tests, hermetic
bun run test:coverage
bun run servers:check       # validate every alias in servers.json
bun run evals               # tool-selection evals via local Claude Code

Integration tests run against real containers:

docker compose -f docker/compose.yml up -d --wait
bun run test:e2e
docker compose -f docker/compose.yml down -v

The fixtures are an echo server that reflects the request it receives, which makes the generated HTTP request directly assertable, and a static server holding the descriptions under docker/specs.

Conformance is checked with the official MCP Inspector against a running worker:

bun run dev
bunx @modelcontextprotocol/inspector@2 --cli \
  --transport http --server-url http://127.0.0.1:8787/petstore/mcp \
  --method tools/list --strict

Layout

Out of Scope

Sampling, roots and logging are deprecated in the current specification with removal scheduled, so MyMCP does not implement them.

License

Mozilla Public License 2.0. See LICENSE.