OpenAPI MCP Server Generators: Swagger to MCP

Q: What is the best OpenAPI to MCP generator?

It depends on your stack. FastMCP's from_openapi() is quickest in Python and needs no generated code. openapi-mcp-generator writes a TypeScript project you own and supports the 2026-07-28 spec. AWS Labs' server runs from a spec URL with uvx. Whichever you pick, trim the spec before you ship.

On this page

OpenAPI to MCP: Turn a Swagger Spec Into a Lean MCP Server (Nov 2026)

To turn an OpenAPI (Swagger) spec into an OpenAPI MCP server, point a generator at the spec file. FastMCP, openapi-mcp-generator, AWS Labs' OpenAPI MCP Server and Speakeasy each make one MCP tool per API endpoint. That's fine for a small API. For a big one, trim the spec first, or the tool list floods the model's context.

This guide covers the tools, the one problem they all share, and what to cut. If you're still deciding whether your API needs MCP at all, read MCP vs API first. Going the other way, from an MCP server to an OpenAPI endpoint? Jump to MCP to OpenAPI.

How OpenAPI to MCP conversion works

An OpenAPI file lists every endpoint of a REST API: its path, method, parameters and request body. An MCP tool is a name, a description and an input schema. The MCP spec (2026-07-28) defines inputSchema as "JSON Schema defining expected parameters". OpenAPI already describes parameters in JSON Schema, so the mapping is mostly mechanical:

OpenAPI	Becomes in MCP
One operation (`GET /customers/{id}`)	One tool
`operationId`	Tool `name`
`summary` / `description`	Tool `description` (what the model reads)
Path, query and body parameters	`inputSchema`
2xx response schema	`outputSchema` (some generators, optional)
`servers` + security schemes	The base URL and credentials the server calls with

When the model calls the tool, the MCP server builds the HTTP request, sends it to your API and hands the response back.

One detail trips up converted specs: names. The spec says tool names SHOULD use only letters, digits, _, - and ., and be 1 to 128 characters. A raw path like /customers/{id} can't be a name, so generators use operationId. If your specs have auto-made ids like getUsingGET_1, that's what the model sees.

OpenAPI MCP generators and servers compared

There are three kinds of tool. A generator writes a server project you own and edit. A runtime converter reads the spec each time it starts, so there's no code to keep in sync. A gateway does the conversion as a hosted or self-hosted proxy.

Tool	Kind	Runtime	How you trim it
FastMCP `FastMCP.from_openapi()`	Runtime converter	Python	`RouteMap` rules by method, path pattern or tag, with `MCPType.EXCLUDE`
openapi-mcp-generator	Generator (CLI)	Writes a TypeScript project	`x-mcp: false` in the spec, `--include-tags`, `--exclude-tags`, `--include-operations`, `--exclude-operations`
AWS Labs OpenAPI MCP Server	Runtime converter	Python (`uvx`)	`--include-tags`, `--exclude-tags`
Speakeasy	Generator (CLI)	Writes a TypeScript server	`x-speakeasy-mcp` in the spec, `--scope read`, `--tool <name>`, `--mode dynamic`
FastAPI-MCP	Library	Python, FastAPI apps only	Works from your app's routes, not a spec file
Higress openapi-to-mcp	Gateway config	Go CLI, writes Higress YAML	Edit the YAML, or patch it with `--template`

Details worth knowing before you pick one:

FastMCP (Apache-2.0, v4.1.7, November 2026) is the quickest route if you write Python. Its own docs warn that "LLMs achieve significantly better performance with well-designed and curated MCP servers than with auto-converted OpenAPI servers". They recommend it for bootstrapping and prototyping, not for mirroring your whole API. How it compares with the official SDK: Python MCP SDK vs FastMCP.
openapi-mcp-generator (MIT, v5.0.1, October 2026) builds on the MCP TypeScript SDK v2 and supports the 2026-07-28 spec. It can emit stdio, Streamable HTTP or a Cloudflare Worker. Version 5 refuses Swagger 2.0 files (see Swagger MCP).
AWS Labs OpenAPI MCP Server (Apache-2.0) "Works with OpenAPI 3.x specifications in JSON or YAML format". It handles Basic, Bearer, API key and Cognito auth, and can also generate prompts from the API's structure.
Speakeasy starts with speakeasy quickstart --mcp. Its --mode dynamic swaps the tool list for a few discovery tools (more on that below).
FastAPI-MCP (MIT) mounts an MCP server on an existing FastAPI app and reuses its Depends() auth. Its last release was v0.4.0 in July 2025, so check it works with your client before you rely on it.
Gateways convert APIs without code. Amazon Bedrock AgentCore Gateway turns OpenAPI and Smithy APIs into tools, and IBM's ContextForge "Adapts REST APIs into tools". See open-source and managed MCP gateways.
Stainless used to generate MCP servers from specs. It joined Anthropic in May 2026 and said it is "winding down all hosted Stainless products", with new signups and projects no longer available. Older comparison posts still list it.

Three quick starts, taken from each project's README or docs. FastMCP, with the admin and internal routes dropped:

import httpx2
from fastmcp import FastMCP
from fastmcp.server.providers.openapi import RouteMap, MCPType

client = httpx2.AsyncClient(base_url="https://api.example.com")
spec = httpx2.get("https://api.example.com/openapi.json").json()

mcp = FastMCP.from_openapi(
    openapi_spec=spec,
    client=client,
    name="My API Server",
    route_maps=[
        RouteMap(pattern=r"^/admin/.*", mcp_type=MCPType.EXCLUDE),
        RouteMap(tags={"internal"}, mcp_type=MCPType.EXCLUDE),
    ],
)

if __name__ == "__main__":
    mcp.run()

openapi-mcp-generator, writing a Streamable HTTP project:

npx openapi-mcp-generator --input ./openapi.json --output ./my-mcp --transport=streamable-http --port=3000

AWS Labs, loading only the pet endpoints of the Petstore demo API:

awslabs.openapi-mcp-server --api-url https://petstore3.swagger.io/api/v3 --spec-url https://petstore3.swagger.io/api/v3/openapi.json --include-tags pet

Swagger MCP: Swagger 2.0 files and SmartBear's Swagger server

"Swagger" is the old name for OpenAPI. Swagger 2.0 files are the older format, and OpenAPI 3.x is the current one. People searching "swagger mcp" usually want one of two things.

1. Turn a swagger.json into an MCP server. Most converters expect OpenAPI 3. openapi-mcp-generator v5 refuses Swagger 2.0 and tells you to convert it first:

npx swagger2openapi swagger.json -o openapi.json

AWS Labs' server also lists OpenAPI 3.x only. Convert once, check the result in your usual API tooling, then feed the 3.x file to the generator.

2. Use Swagger itself from an AI client. SmartBear, which makes Swagger, runs an official MCP server for its products: Swagger Portal, Swagger Studio ("AI-powered API generation from prompts"), contract testing and functional testing. The hosted version is at https://swagger.mcp.smartbear.com/mcp, and sign-in "is handled through an OAuth browser flow", per its README. It manages your API designs in Swagger's tools. It doesn't turn your API into tools.

Why a 1:1 endpoint mapping floods the context

Every tool you expose gets loaded into the model's context: its name, description and full input schema. That happens on every request, whether the model uses the tool or not. A 300-endpoint API converted 1:1 becomes 300 tools.

Cloudflare measured this on its own API. The full OpenAPI spec is about 2 million tokens. One tool per endpoint would still cost about 244,000 tokens of context. Its MCP server uses code mode instead: the model searches the spec and calls the API through two tools, and the whole tool list costs about 1,000 tokens (details in our Cloudflare MCP guide).

Size isn't the only cost. A long list of near-identical tools (list_invoices, get_invoice, search_invoices, list_invoice_items) makes it harder for the model to pick the right one. REST endpoints are also built for programs that chain small calls. A model does better with one tool that matches a task, like "find the customer by email and show their open invoices".

How to measure what your servers cost now: why MCP servers eat your context window.

Turn an OpenAPI spec into a lean MCP server in 6 steps

Work on a copy of the spec, or use your generator's filters, so the public API docs stay as they are.

1. Pick the tasks first, then the endpoints

Write down the five to ten things people will actually ask the AI to do. Keep only the endpoints those tasks need. Everything else is context you pay for and a call the model might make by mistake.

2. Drop admin, internal and deprecated endpoints

Exclude them by tag or path: x-mcp: false (openapi-mcp-generator, at the root, path or operation level), MCPType.EXCLUDE (FastMCP), or --exclude-tags admin,internal (AWS Labs).

3. Start read-only

Ship the GET endpoints first and add writes one at a time. Speakeasy's --scope read "only mounts tools tagged with the read scope". In FastMCP, match on methods=["GET"]. openapi-mcp-generator marks GET tools read-only and DELETE tools destructive, which helps clients decide when to ask you first. Then lock it down in the client too: how to limit MCP tools.

4. Rename tools and rewrite descriptions for the model

Give each tool a short verb name (find_customer, not getUsingGET_1). Set a clean operationId in your copy of the spec, or use FastMCP's mcp_names map. Speakeasy's x-speakeasy-mcp extension can "Customize tool names, descriptions, and scopes." In the description, say when to use the tool and what it returns, in one or two sentences.

5. Shrink the schemas

Remove optional parameters nobody sets, long enum lists and deep nesting. Every property you keep is loaded into context with every request, so a lean schema pays off on each call.

6. Keep responses small

Default to small pages and a few fields. A tool that returns a 2 MB JSON blob fills the context just as fast as a long tool list. FastMCP cuts non-JSON error text to 1,000 characters for you; large success responses are up to your API design.

Dynamic tools and code mode: when the API is too big to trim

Some APIs really do need hundreds of operations. Two patterns keep the tool list small anyway:

Discovery tools. Speakeasy's --mode dynamic exposes only meta-tools (list_tools, describe_tool, execute_tool, list_scopes). The model looks up the endpoint it needs, then calls it.
Code mode. The model writes a short script that searches the spec and calls the API, as Cloudflare's server does with search and execute.

Both cost extra round trips and are harder to audit, because one tool can reach every endpoint. Some clients can also load tool definitions on demand; see step 5 of our context guide.

MCP to OpenAPI: expose an MCP server as a REST API

The reverse trip is for apps that speak OpenAPI but not MCP, like Open WebUI's tool servers. mcpo (MIT, by the Open WebUI team) is "a dead-simple proxy that takes an MCP server command and makes it accessible via standard RESTful OpenAPI". From its README:

uvx mcpo --port 8000 --api-key "top-secret" -- your_mcp_server_command

It then serves an OpenAPI schema with live docs at http://localhost:8000/docs. For a remote server, pass --server-type "streamable-http" and the server's URL instead of a command. Keep the --api-key and don't expose the port to the internet: anyone who can reach it can call every tool.

MCP REST API: when not to convert at all

An MCP server on top of a REST API is still a REST API underneath. MCP adds discovery and a standard way for AI clients to call it; it doesn't make the API easier or safer. If no model is in the loop, or the call is always the same, call the API directly. The full comparison: MCP vs REST API and when a plain API is the better choice.

Security checks for a generated MCP server

A generator copies your API's reach into a tool the model can call. Check these before you connect it:

Use a narrow token. The server calls your API with whatever credential you give it. A read-only, single-project key limits the damage of a bad call: the token or role is the real limit.
Turn on inbound auth for HTTP. openapi-mcp-generator's --inbound-auth defaults to none; set it to bearer and clients must send Authorization: Bearer <token>. For anything shared, use OAuth: MCP server authentication and Streamable HTTP security.
Keep the spec's own rules. The MCP spec says servers "MUST" validate all tool inputs, apply access controls, rate limit tool calls and sanitize tool outputs. A thin proxy over your API only does that if your API does. FastMCP's mask_error_details=True keeps upstream error details away from callers.
Treat API responses as untrusted text. A customer note or ticket body that says "ignore your instructions" goes straight to the model.

When to hand-build instead

Generate when you want a quick prototype, an internal tool, or a first look at which endpoints matter. Hand-build when outside users will rely on it, when writes touch money or permissions, or when the API is big. In practice a good path is to generate first, watch which tools get used, then rewrite the five or ten that matter as proper task tools. Well-graded official servers like Stripe and GitHub expose a chosen set of tools, not every endpoint of their APIs.

Want an MCP server on your API that stays small, safe and easy to grade? Tell us what you need to connect.

Frequently asked questions

What is the best OpenAPI to MCP generator?

It depends on your stack. FastMCP's from_openapi() is quickest in Python and needs no generated code. openapi-mcp-generator writes a TypeScript project you own and supports the 2026-07-28 spec. AWS Labs' server runs from a spec URL with uvx. Whichever you pick, trim the spec before you ship.

Can I turn a Swagger 2.0 file into an MCP server?

Yes, but convert it to OpenAPI 3 first. openapi-mcp-generator v5 refuses Swagger 2.0 and suggests npx swagger2openapi swagger.json -o openapi.json. AWS Labs' OpenAPI MCP Server also expects OpenAPI 3.x.

What is Swagger MCP?

Usually one of two things: an MCP server generated from a Swagger or OpenAPI file, or SmartBear's official MCP server for its Swagger products, hosted at https://swagger.mcp.smartbear.com/mcp. The first exposes your API to an AI client. The second lets an AI client work with your API designs in Swagger.

How many tools should an MCP server generated from OpenAPI have?

There's no fixed number, but fewer is better. Start with the endpoints your top five to ten tasks need. If the API is too big to trim, use a dynamic or code-mode design so the model sees a handful of tools instead of hundreds.

What is an OpenAPI MCP server?

An MCP server built from an OpenAPI spec. Each API operation becomes an MCP tool, and when the model calls it the server sends the HTTP request to your API. Generators such as FastMCP, openapi-mcp-generator, AWS Labs and Speakeasy do the conversion.

Can I convert an MCP server to OpenAPI?

Yes. mcpo wraps an MCP server and serves it as a REST API with an OpenAPI schema, for apps that speak OpenAPI but not MCP. Run it with an --api-key and keep the port private.

How do I use an MCP server as a REST API?

Wrap it with mcpo, which serves the MCP server as a REST API with an OpenAPI schema and live docs. In the other direction, an MCP server on top of a REST API is still that REST API underneath, so call the API directly when no model is in the loop.

Is an MCP server generated from OpenAPI safe to use?

It's as safe as the token it holds and the endpoints it exposes. A generator doesn't add checks your API doesn't already have. Use a read-only token, drop write and admin endpoints you don't need, and require sign-in on any HTTP endpoint.