# OpenAPI MCP Server

This project is a server that dynamically creates Model Context Protocol (MCP) tools and resources from OpenAPI specifications. It allows Large Language Models (LLMs) to interact with APIs through the Model Context Protocol.

## Origin and derivation

This is an independently maintained fork of the [`awslabs/mcp` OpenAPI MCP Server](https://github.com/awslabs/mcp/tree/main/src/openapi-mcp-server). The implementation, AWS copyright notices, `LICENSE`, and `NOTICE` are retained in accordance with the Apache License 2.0. The fork is maintained at [`samuelcaldas/openapi-mcp-server`](https://github.com/samuelcaldas/openapi-mcp-server), while AWS remains the credited upstream origin.

The server defaults to `stdio` for local MCP clients and also supports Streamable HTTP (`/mcp`) and legacy SSE (`/sse`). Network transports are unauthenticated at the MCP layer: keep the default loopback bind, or place remote deployments behind an operator-managed, authenticated gateway.

Upstream synchronization is deliberately manual. Run `./scripts/sync-upstream.sh` from a clean `main` checkout after installing `git-filter-repo`, or dispatch the [Sync upstream workflow](https://github.com/samuelcaldas/openapi-mcp-server/actions/workflows/sync-upstream.yml) on `main`. The script keeps the filtered AWS history under `refs/remotes/upstream/main`, creates `chore(sync): update from awslabs/mcp` only when the merge changes the tree, and aborts on conflicts.

## Features

- **Dynamic Tool Generation**: Automatically creates MCP tools from OpenAPI endpoints
- **Intelligent Route Mapping**: Maps GET operations with query parameters to TOOLS instead of RESOURCES
  - Makes API operations with query parameters easier for LLMs to understand and use
  - Improves usability of search and filtering endpoints
  - Configurable via the route_patch module
- **Tag-based Filtering**: Control which operations are exposed to LLMs
  - Include only specific tags: `--include-tags pet,store`
  - Exclude specific tags: `--exclude-tags admin,internal`
  - Configurable via CLI args or `INCLUDE_TAGS` / `EXCLUDE_TAGS` env vars
- **Enriched Tool Descriptions**: Automatically appends response codes and parameter examples from the OpenAPI spec to tool descriptions, helping LLMs make better tool selections
- **Multi-spec Composition**: Combine multiple OpenAPI specs into a single MCP server
  - Configure via `--additional-specs` CLI arg or `ADDITIONAL_SPECS` env var
  - Each spec gets its own HTTP client with independent authentication (per-entry `auth_type`, `auth_token`, etc.)
  - SSRF-protected: URLs are validated against DNS resolution and IP allowlisting before fetching
- **Output Validation Toggle**: Disable response schema validation for APIs with loose specs via `--no-validate-output` or `VALIDATE_OUTPUT=false`
- **Dynamic Prompt Generation**: Creates helpful prompts based on API structure
  - **Operation-Specific Prompts**: Generates natural language prompts for each API operation
  - **API Documentation Prompts**: Creates comprehensive API documentation prompts
  - **Prompt Optimization**: Implements token efficiency strategies to reduce costs and enhance clarity
    - Follows MCP-compliant structure with name, description, arguments, and metadata
    - Achieves 70-75% reduction in token usage while maintaining functionality
    - Uses concise descriptions with essential information for better developer experience
- **Transport**: `stdio` by default; Streamable HTTP (`--transport http` or `--transport streamable-http`) at `/mcp`; legacy SSE (`--transport sse`) at `/sse`
- **Flexible Configuration**: Configure via environment variables or command line arguments
- **OpenAPI Support**: Works with OpenAPI 3.x specifications in JSON or YAML format
- **OpenAPI Specification Validation**: Validates specifications without failing startup if issues detected, logging warnings instead to work with specs having minor issues or non-standard extensions
- **Authentication Support**: Supports multiple authentication methods (Basic, Bearer Token, API Key, Cognito)
- **AWS Best Practices**: Implements AWS best practices for caching, resilience, and observability
- **Comprehensive Testing**: Includes extensive unit and integration tests with high code coverage
- **Metrics Collection**: Tracks API calls, tool usage, errors, and performance metrics

## Installation

| Kiro | Cursor | VS Code |
|:----:|:------:|:-------:|
| [![Add to Kiro](https://kiro.dev/images/add-to-kiro.svg)](https://kiro.dev/launch/mcp/add?name=awslabs.openapi-mcp-server&config=%7B%22command%22%3A%22uvx%22%2C%22args%22%3A%5B%22awslabs.openapi-mcp-server%40latest%22%5D%2C%22env%22%3A%7B%22API_NAME%22%3A%22your-api-name%22%2C%22API_BASE_URL%22%3A%22https%3A//api.example.com%22%2C%22API_SPEC_URL%22%3A%22https%3A//api.example.com/openapi.json%22%2C%22LOG_LEVEL%22%3A%22ERROR%22%2C%22ENABLE_PROMETHEUS%22%3A%22false%22%2C%22ENABLE_OPERATION_PROMPTS%22%3A%22true%22%2C%22UVICORN_TIMEOUT_GRACEFUL_SHUTDOWN%22%3A%225.0%22%2C%22UVICORN_GRACEFUL_SHUTDOWN%22%3A%22true%22%7D%7D) | [![Install MCP Server](https://cursor.com/deeplink/mcp-install-light.svg)](https://cursor.com/en/install-mcp?name=awslabs.openapi-mcp-server&config=eyJjb21tYW5kIjoidXZ4IGF3c2xhYnMub3BlbmFwaS1tY3Atc2VydmVyQGxhdGVzdCIsImVudiI6eyJBUElfTkFNRSI6InlvdXItYXBpLW5hbWUiLCJBUElfQkFTRV9VUkwiOiJodHRwczovL2FwaS5leGFtcGxlLmNvbSIsIkFQSV9TUEVDX1VSTCI6Imh0dHBzOi8vYXBpLmV4YW1wbGUuY29tL29wZW5hcGkuanNvbiIsIkxPR19MRVZFTCI6IkVSUk9SIiwiRU5BQkxFX1BST01FVEhFVVMiOiJmYWxzZSIsIkVOQUJMRV9PUEVSQVRJT05fUFJPTVBUUyI6InRydWUiLCJVVklDT1JOX1RJTUVPVVRfR1JBQ0VGVUxfU0hVVERPV04iOiI1LjAiLCJVVklDT1JOX0dSQUNFRlVMX1NIVVRET1dOIjoidHJ1ZSJ9LCJkaXNhYmxlZCI6ZmFsc2UsImF1dG9BcHByb3ZlIjpbXX0%3D) | [![Install on VS Code](https://img.shields.io/badge/Install_on-VS_Code-FF9900?style=flat-square&logo=visualstudiocode&logoColor=white)](https://insiders.vscode.dev/redirect/mcp/install?name=OpenAPI%20MCP%20Server&config=%7B%22command%22%3A%22uvx%22%2C%22args%22%3A%5B%22awslabs.openapi-mcp-server%40latest%22%5D%2C%22env%22%3A%7B%22API_NAME%22%3A%22your-api-name%22%2C%22API_BASE_URL%22%3A%22https%3A%2F%2Fapi.example.com%22%2C%22API_SPEC_URL%22%3A%22https%3A%2F%2Fapi.example.com%2Fopenapi.json%22%2C%22LOG_LEVEL%22%3A%22ERROR%22%2C%22ENABLE_PROMETHEUS%22%3A%22false%22%2C%22ENABLE_OPERATION_PROMPTS%22%3A%22true%22%2C%22UVICORN_TIMEOUT_GRACEFUL_SHUTDOWN%22%3A%225.0%22%2C%22UVICORN_GRACEFUL_SHUTDOWN%22%3A%22true%22%7D%2C%22disabled%22%3Afalse%2C%22autoApprove%22%3A%5B%5D%7D) |

### From PyPI

```bash
pip install "awslabs.openapi-mcp-server"
```

### Optional Dependencies

The package supports several optional dependencies:

```bash
# For YAML OpenAPI specification support
pip install "awslabs.openapi-mcp-server[yaml]"

# For Prometheus metrics support
pip install "awslabs.openapi-mcp-server[prometheus]"

# For testing
pip install "awslabs.openapi-mcp-server[test]"

# For all optional dependencies
pip install "awslabs.openapi-mcp-server[all]"
```

### From Source

```bash
git clone https://github.com/samuelcaldas/openapi-mcp-server.git
cd openapi-mcp-server
pip install -e .
```

### Using MCP Configuration

Example configuration for Kiro (`~/.kiro/settings/mcp.json`):

```json
{
  "mcpServers": {
    "awslabs.openapi-mcp-server": {
      "command": "uvx",
      "args": ["awslabs.openapi-mcp-server@latest"],
      "env": {
        "API_NAME": "your-api-name",
        "API_BASE_URL": "https://api.example.com",
          "API_SPEC_URL": "https://api.example.com/openapi.json",
          "LOG_LEVEL": "ERROR",
          "ENABLE_PROMETHEUS": "false",
          "ENABLE_OPERATION_PROMPTS": "true",
          "UVICORN_TIMEOUT_GRACEFUL_SHUTDOWN": "5.0",
          "UVICORN_GRACEFUL_SHUTDOWN": "true"
      },
      "disabled": false,
      "autoApprove": []
    }
  }
}
```

### Windows Installation

For Windows users, the MCP server configuration format is slightly different:

```json
{
  "mcpServers": {
    "awslabs.openapi-mcp-server": {
      "disabled": false,
      "timeout": 60,
      "type": "stdio",
      "command": "uv",
      "args": [
        "tool",
        "run",
        "--from",
        "awslabs.openapi-mcp-server@latest",
        "awslabs.openapi-mcp-server.exe"
      ],
      "env": {
          "API_NAME": "your-api-name",
          "API_BASE_URL": "https://api.example.com",
          "API_SPEC_URL": "https://api.example.com/openapi.json",
          "LOG_LEVEL": "ERROR",
          "ENABLE_PROMETHEUS": "false",
          "ENABLE_OPERATION_PROMPTS": "true",
          "UVICORN_TIMEOUT_GRACEFUL_SHUTDOWN": "5.0",
          "UVICORN_GRACEFUL_SHUTDOWN": "true"
      }
    }
  }
}
```

## Usage

### Basic Usage

```bash
# Start with Petstore API example
awslabs.openapi-mcp-server --api-name petstore --api-url https://petstore3.swagger.io/api/v3 --spec-url https://petstore3.swagger.io/api/v3/openapi.json
```

### Custom API

```bash
# Use a different API
awslabs.openapi-mcp-server --api-name myapi --api-url https://api.example.com --spec-url https://api.example.com/openapi.json
```

### Network Transports

`stdio` is the default. Use Streamable HTTP (`/mcp`) or legacy SSE (`/sse`) when an MCP client needs a network endpoint:

```bash
# Streamable HTTP on loopback; HTTP path defaults to /mcp
awslabs.openapi-mcp-server --transport http --host 127.0.0.1 --port 8000 --api-url https://api.example.com --spec-url https://api.example.com/openapi.json

# Remote bind only behind an operator-managed authenticated gateway
awslabs.openapi-mcp-server --transport streamable-http --host 0.0.0.0 --port 8000 --http-path /mcp --allow-remote-bind --allowed-origins https://mcp.example.com --api-url https://api.example.com --spec-url https://api.example.com/openapi.json
```

Remote bind does not add inbound MCP authentication. Protect the endpoint with an authenticated gateway; `--allowed-origins` accepts exact HTTP(S) origins, not paths or wildcards. Host and Origin checks remain enabled, including for remote binds. Use `--http-path` to select the Streamable HTTP endpoint. SSE is retained for compatibility and uses `/sse`.

### Authenticated API

```bash
# Basic Authentication
awslabs.openapi-mcp-server --api-url https://api.example.com --spec-url https://api.example.com/openapi.json --auth-type basic --auth-username YOUR_USERNAME --auth-password YOUR_PASSWORD # pragma: allowlist secret

# Bearer Token Authentication
awslabs.openapi-mcp-server --api-url https://api.example.com --spec-url https://api.example.com/openapi.json --auth-type bearer --auth-token YOUR_TOKEN # pragma: allowlist secret

# API Key Authentication (in header)
awslabs.openapi-mcp-server --api-url https://api.example.com --spec-url https://api.example.com/openapi.json --auth-type api_key --auth-api-key YOUR_API_KEY --auth-api-key-name X-API-Key --auth-api-key-in header # pragma: allowlist secret
```

For detailed information about authentication methods, configuration options, and examples, see [AUTHENTICATION.md](AUTHENTICATION.md).

### Local OpenAPI Specification

```bash
# Use a local OpenAPI specification file
awslabs.openapi-mcp-server --spec-path ./openapi.json
```

### Tag Filtering

```bash
# Only expose pet-related operations
awslabs.openapi-mcp-server --api-url https://petstore3.swagger.io/api/v3 --spec-url https://petstore3.swagger.io/api/v3/openapi.json --include-tags pet

# Hide admin and internal operations
awslabs.openapi-mcp-server --api-url https://api.example.com --spec-url https://api.example.com/openapi.json --exclude-tags admin,internal
```

### Multi-spec Composition

```bash
# Combine multiple APIs into one MCP server (each with its own auth)
awslabs.openapi-mcp-server --api-url https://api.example.com --spec-url https://api.example.com/openapi.json \
  --additional-specs '[{"name":"payments","spec_url":"https://payments.example.com/openapi.json","base_url":"https://payments.example.com","auth_type":"bearer","auth_token":"your-payments-bearer-token"}]'

# Additional specs may also use a local OpenAPI file via spec_path
awslabs.openapi-mcp-server --api-url https://api.example.com --spec-url https://api.example.com/openapi.json \
  --additional-specs '[{"name":"payments","spec_path":"./specs/payments-openapi.json","base_url":"https://payments.example.com"}]'

# Allow HTTP URLs and private networks (for internal/development APIs)
awslabs.openapi-mcp-server --api-url https://api.example.com --spec-url https://api.example.com/openapi.json \
  --allow-insecure-http --allow-private-networks \
  --additional-specs '[{"name":"internal","spec_url":"http://10.0.0.5:8080/openapi.json","base_url":"http://10.0.0.5:8080"}]'
```

> **Note:** Additional specs do not inherit the primary API's credentials. Each entry must declare its own `auth_type`/`auth_token`/`auth_api_key` or defaults to no authentication. See the [Security](#security) section for details.

### Disable Output Validation

```bash
# For APIs with loose specs that don't match their own response schemas
awslabs.openapi-mcp-server --api-url https://api.example.com --spec-url https://api.example.com/openapi.json --no-validate-output
```

### YAML OpenAPI Specification

```bash
# Use a YAML OpenAPI specification file (requires pyyaml)
pip install "awslabs.openapi-mcp-server[yaml]"
awslabs.openapi-mcp-server --spec-path ./openapi.yaml
```

### Local Development and Testing

For local development and testing, you can use the `uvx` command with the `--refresh` and `--from` options:

```bash
# Run the server from the local directory with the Petstore API
uvx --refresh --from . awslabs.openapi-mcp-server --api-url https://petstore3.swagger.io/api/v3 --spec-url https://petstore3.swagger.io/api/v3/openapi.json --log-level DEBUG
```

**Command Options Explained:**

- `uvx` - The uv package manager's execution tool for running Python packages
- `--refresh` - Refreshes the package cache to ensure the latest version is used (important during development)
- `--from .` - Uses the package from the current directory instead of installing from PyPI
- `awslabs.openapi-mcp-server` - The package name to run
- `--api-url` - The base URL of the API
- `--spec-url` - The URL of the OpenAPI specification
- `--log-level DEBUG` - Sets the logging level to DEBUG for more detailed logs (useful for development)
**When to Use These Options:**

- Use `--refresh` when you've made changes to your code and want to ensure the latest version is used
- Use `--log-level DEBUG` when you need detailed logs for troubleshooting or development

**Note:** The Petstore API is a standard OpenAPI schema endpoint that can be used for simple testing without any API authentication configuration. It's perfect for testing your MCP server implementation without setting up your own API.

## Configuration

### Environment Variables

```bash
# Server configuration
export SERVER_NAME="My API Server"
export SERVER_DEBUG=true
export SERVER_MESSAGE_TIMEOUT=60
export SERVER_HOST="127.0.0.1"  # Default loopback bind; non-loopback needs ALLOW_REMOTE_BIND
export SERVER_PORT=8000
export SERVER_TRANSPORT="stdio"  # Options: stdio, http, streamable-http, sse
export SERVER_HTTP_PATH="/mcp"  # Streamable HTTP endpoint; SSE uses /sse
export ALLOW_REMOTE_BIND="false"  # Set true only behind an authenticated secure gateway
export ALLOWED_ORIGINS=""  # Comma-separated exact http(s) origins trusted for browser/proxy requests
export LOG_LEVEL="INFO"  # Options: DEBUG, INFO, WARNING, ERROR, CRITICAL

# Metrics and monitoring configuration
export ENABLE_PROMETHEUS="false"  # Enable/disable Prometheus metrics (default: false)
export PROMETHEUS_PORT=9090  # Port for Prometheus metrics server
export ENABLE_OPERATION_PROMPTS="true"  # Enable/disable operation-specific prompts (default: true)

# Graceful shutdown configuration
export UVICORN_TIMEOUT_GRACEFUL_SHUTDOWN=5.0  # Timeout for graceful shutdown in seconds
export UVICORN_GRACEFUL_SHUTDOWN=true  # Enable/disable graceful shutdown

# API configuration
export API_NAME="myapi"
export API_BASE_URL="https://api.example.com"
export API_SPEC_URL="https://api.example.com/openapi.json"
export API_SPEC_PATH="/path/to/local/openapi.json"  # Optional: local file path

# Authentication configuration
export AUTH_TYPE="none"  # Options: none, basic, bearer, api_key
export AUTH_USERNAME="PLACEHOLDER_USERNAME"  # For basic authentication # pragma: allowlist secret
export AUTH_PASSWORD="PLACEHOLDER_PASSWORD"  # For basic authentication # pragma: allowlist secret
export AUTH_TOKEN="PLACEHOLDER_TOKEN"  # For bearer token authentication # pragma: allowlist secret
export AUTH_API_KEY="PLACEHOLDER_API_KEY"  # For API key authentication # pragma: allowlist secret
export AUTH_API_KEY_NAME="X-API-Key"  # Name of the API key (default: api_key)
export AUTH_API_KEY_IN="header"  # Where to place the API key (options: header, query, cookie)

# Tag filtering
export INCLUDE_TAGS="pet,store"  # Only expose operations with these tags
export EXCLUDE_TAGS="admin,internal"  # Hide operations with these tags

# Output validation
export VALIDATE_OUTPUT="true"  # Set to "false" to disable response schema validation

# Multi-spec composition
# Each additional spec requires base_url and either spec_url or spec_path
# Each entry can optionally include auth_type, auth_token, auth_api_key, auth_api_key_name, auth_username, auth_password
export ADDITIONAL_SPECS='[{"name":"payments","spec_url":"https://payments.example.com/openapi.json","base_url":"https://payments.example.com","auth_type":"api_key","auth_api_key":"PLACEHOLDER_API_KEY","auth_api_key_name":"X-API-Key"}]' # pragma: allowlist secret

# Security settings
export ALLOW_INSECURE_HTTP="false"       # Set to "true" to permit http:// URLs
export ALLOW_PRIVATE_NETWORKS="false"    # Set to "true" to permit private/loopback/link-local IPs
export ALLOWED_SPEC_DIRS="/app/specs:/data/api"  # OS path-separated list of allowed directories for spec_path (use ; on Windows)
```

## Documentation

The OpenAPI MCP Server includes comprehensive documentation to help you get started and make the most of its features:

- [**AUTHENTICATION.md**](AUTHENTICATION.md): Detailed information about authentication methods, configuration options, and troubleshooting
- [**DEPLOYMENT.md**](DEPLOYMENT.md): Guidelines for deploying local stdio and network transports in Docker and AWS environments
- [**AWS_BEST_PRACTICES.md**](AWS_BEST_PRACTICES.md): AWS best practices implemented in the server for resilience, caching, and efficiency
- [**OBSERVABILITY.md**](OBSERVABILITY.md): Information about metrics, logging, and monitoring capabilities
- [**tests/README.md**](tests/README.md): Overview of the test structure and strategy

## AWS Best Practices

The OpenAPI MCP Server implements AWS best practices for building resilient, observable, and efficient cloud applications. These include:

- **Caching**: Robust caching system with multiple backend options
- **Resilience**: Patterns to handle transient failures and ensure high availability
- **Observability**: Comprehensive monitoring, metrics, and logging features

For detailed information about these features, including implementation details and configuration options, see [AWS_BEST_PRACTICES.md](AWS_BEST_PRACTICES.md).

## Security

The server validates all URLs in `additional_specs` entries before fetching:

| Blocked by default | Examples |
|-------------------|----------|
| Private networks (RFC 1918) | `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16` |
| Loopback / link-local | `127.0.0.0/8`, `169.254.0.0/16` (AWS IMDS) |
| HTTP scheme | `http://...` (HTTPS required) |

**Credential isolation**: Additional specs never inherit the primary API's credentials. Each entry must declare its own `auth_type`/`auth_token` or defaults to no auth.

**DNS pinning (rebinding protection)**: Spec URLs are validated **and fetched against the same resolved IP** — the loader connects only to the address(es) that passed validation, never re-resolving the hostname at fetch time. This closes the DNS-rebinding TOCTOU window where a hostname could resolve to a public IP during validation and to an internal/metadata IP during the fetch. This applies to both the primary spec URL and every `additional_specs` entry. Redirects are not followed (a `30x` toward an internal host is rejected), and spec bodies are capped at 10 MiB.

**Reference (`$ref`) resolution**: Only internal, in-document references (`#/components/...`) are resolved. External references — remote `http(s)://`/`file://` targets, or relative multi-file references such as `schemas.yaml#/Pet` — are refused before parsing, so a hostile spec cannot use a `$ref` to reach internal services, cloud metadata, or local files (SSRF/LFI). Split multi-file specs must be bundled into a single document before loading.

**Path traversal protection**: `spec_path` is canonicalized, restricted to spec file extensions (`.json`, `.yaml`, `.yml`), and checked against a best-effort system directory blocklist. For production deployments, use `--allowed-spec-dirs` to explicitly restrict allowed paths.

**Escape hatches** for development/internal use:

| Flag | Env Var | Effect |
|------|---------|--------|
| `--allow-insecure-http` | `ALLOW_INSECURE_HTTP=true` | Permits `http://` URLs (still DNS-pinned) |
| `--allow-private-networks` | `ALLOW_PRIVATE_NETWORKS=true` | Permits private/loopback IPs |
| `--allowed-spec-dirs` | `ALLOWED_SPEC_DIRS=/path1:/path2` | Restricts `spec_path` to listed directories |

To report security issues, open a private report through the [repository security policy](https://github.com/samuelcaldas/openapi-mcp-server/security) or contact the maintainers.

## Docker Deployment

The project includes a Dockerfile for containerized deployment. To build and run:

```bash
# Build the Docker image
docker build -t openapi-mcp-server:latest .

# Run Streamable HTTP behind an operator-managed secure gateway
docker run -p 127.0.0.1:8000:8000 \
  -e API_NAME=petstore \
  -e API_BASE_URL=https://petstore3.swagger.io/api/v3 \
  -e API_SPEC_URL=https://petstore3.swagger.io/api/v3/openapi.json \
  -e SERVER_TRANSPORT=http \
  -e SERVER_HOST=0.0.0.0 \
  -e SERVER_PORT=8000 \
  -e ALLOW_REMOTE_BIND=true \
  -e ALLOWED_ORIGINS=https://mcp.example.com \
  -e TZ=America/Sao_Paulo \
  openapi-mcp-server:latest
```

The default `stdio` transport needs no published port. The Docker example binds to host loopback so a same-host authenticated gateway can proxy it without exposing the unauthenticated endpoint externally. If the gateway runs on another host, use a separate trusted container network or firewall that allows only the gateway to reach the server; never publish the port to untrusted networks. Remote network transports have no inbound MCP authentication. See [DEPLOYMENT.md](DEPLOYMENT.md) for transport configuration and security requirements.

## Testing

The project includes a comprehensive test suite covering unit tests, integration tests, and API functionality tests.

### Running Tests

```bash
# Install test dependencies
pip install "awslabs.openapi-mcp-server[test]"

# Run all tests
pytest

# Run tests with coverage
pytest --cov=awslabs

# Run specific test modules
pytest tests/api/
pytest tests/utils/
```

The test suite covers:

1. **API Configuration**: Tests for API configuration handling and validation
2. **API Discovery**: Tests for API endpoint discovery and tool generation
3. **Caching**: Tests for the caching system and providers
4. **HTTP Client**: Tests for the HTTP client with resilience features
5. **Metrics**: Tests for metrics collection and reporting
6. **OpenAPI Validation**: Tests for OpenAPI specification validation

For more information about the test structure and strategy, see the [tests/README.md](tests/README.md) file.

## Instructions

This server acts as a bridge between OpenAPI specifications and LLMs, allowing models to have a better understanding of available API capabilities without requiring manual tool definitions. The server creates structured MCP tools that LLMs can use to understand and interact with your API endpoints, parameters, and response formats.

### Key Features

1. **Dynamic Tool Generation**: Automatically creates MCP tools from your API endpoints
2. **Operation-Specific Prompts**: Generates natural language prompts for each API operation
3. **API Documentation**: Creates comprehensive documentation prompts for the entire API
4. **Authentication Support**: Works with Basic Auth, Bearer Token, API Key, and Cognito authentication

### Getting Started

1. Point the server to your API by providing its name, base URL, and OpenAPI specification URL or local file path.
2. Configure outbound API authentication if required; it does not authenticate inbound MCP clients.
3. Use the default `stdio` transport for local MCP clients, or configure a network transport and secure gateway as described above.

### Monitoring and Metrics

The server includes built-in monitoring capabilities:
- Prometheus metrics (disabled by default)
- Detailed logging of API calls and tool usage
- Performance tracking for API operations

## Testing with Kiro

To test the OpenAPI MCP Server with Kiro, you need to configure Kiro to use your MCP server. Here's how:

1. **Configure Kiro MCP Integration**

   Create or edit the MCP configuration file:

   ```bash
   mkdir -p ~/.kiro/settings
   nano ~/.kiro/settings/mcp.json
   ```

   Add the following configuration:

   ```json
   {
     "mcpServers": {
       "awslabs.openapi-mcp-server": {
         "command": "python",
         "args": ["-m", "awslabs.openapi_mcp_server"],
         "cwd": "/path/to/your/openapi-mcp-server",
         "env": {
           "API_NAME": "petstore",
           "API_BASE_URL": "https://petstore3.swagger.io/api/v3",
           "API_SPEC_URL": "https://petstore3.swagger.io/api/v3/openapi.json",
           "LOG_LEVEL": "INFO",
           "ENABLE_PROMETHEUS": "false",
           "ENABLE_OPERATION_PROMPTS": "true",
           "UVICORN_TIMEOUT_GRACEFUL_SHUTDOWN": "5.0",
           "UVICORN_GRACEFUL_SHUTDOWN": "true",
           "PYTHONPATH": "/path/to/your/openapi-mcp-server"
         },
         "disabled": false,
         "autoApprove": []
       }
     }
   }
   ```

2. **Start Kiro CLI**

   Launch the Kiro CLI:

   ```bash
   kiro-cli chat
   ```

3. **Test the Operation Prompts**

   Once connected, you can test the operation prompts by asking Kiro to help you with specific API operations:

   ```
   I need to find a pet by ID using the Petstore API
   ```

   Kiro should respond with guidance using the natural language prompt.