MCP-Generator

Also available in: Português (Versão em Português)

Generate MCP servers from OpenAPI specs.

Status: @christopher_dondici/mcp-gen 2.3.7 is the latest published version on npm; 2.4.0 is prepared (publication pending). See release notes (PT-BR).

mcp-gen turns an OpenAPI v3 or Swagger 2.0 spec into an MCP server in TypeScript, Python, or Go. It maps each route to a tool, generates typed models (including enums, oneOf/anyOf), and keeps custom code when you regenerate.

What’s new in 2.4.0

(Minor release — no breaking changes. Prepared, publication pending. Includes the unreleased 2.3.8 content.)

• Inline oneOf/anyOf variants become synthetic union members with expanded properties instead of warnings; discriminator stays advisory-only.
• Nested inline allOf members expand recursively; requestBody.$ref to schemas/* resolves as the body param (to parameters/* warns instead of dropping silently).
• $ref parameters via components.parameters are resolved; unresolvable ones warn; pnpm-lock.yaml and bun.lock/bun.lockb are skipped by the credential scan.
• Also: SDK 1.30.0 → 1.32.1, proxy-addr → 2.0.8, handlebars → 4.7.10 (prod audit clean); streamed remote reads with 50MB cap; CI on Node 22 with pinned ubuntu-24.04; 4 Wave 1 lows.
• Local verification: 19 Jest suites / 265 tests, CLI exit-code smoke 4/4, TypeScript/Python/Go generated-server smokes, npm audit --omit=dev clean.

What’s new in 2.3.7

What’s new in 2.5.0

(Minor release — no breaking changes.)

• Remote URL watch retries transient fetch failures instead of dropping the polling cycle: network errors and 408/425/429/500/502/503/504 responses are retried with exponential backoff, while other 4xx responses fail immediately.
• New --retries (default 2) and --retry-delay (default 500) flags control the retry budget and the base backoff, which doubles on each attempt. --retries 0 keeps the previous single-attempt behaviour.
• Fetch failures now carry the HTTP status code, so callers can branch on it without parsing error messages.
• Local verification: 19 Jest suites / 272 tests, HTTPS retry smoke against a live TLS server (503, 503, 200 → success), lint + typecheck clean.

(Patch release — no breaking changes.)

• Tool names use the sanitized operationId when present, with fallback to method_path.
• allOf with $ref merges referenced properties; requestBody resolves via components.requestBodies; trace is a supported method.
• security --json prints pure JSON on stdout for CI parsing; --plugin accepts a directory or a module file.
• URL watch validates the URL, enforces a 30s timeout and content checks, and compares by SHA-256 hash.
• security-lint has fewer false positives (anchored base64 regex, lockfiles skipped, all specs scanned).
• CI adds generated-Python smoke and production dependency audit.