Converting a REST API to an MCP Server

What the converter does

AI agents (Claude, Cursor, and your customers' custom agents) do not call REST APIs directly — they call MCP (Model Context Protocol) tools. If your product has a REST API but no MCP server, agents cannot use it. The free OpenAPI → MCP converter turns your existing API into a server an agent can call.

Paste your OpenAPI 3.x or Swagger 2.0 specification (as JSON), or give its URL and we fetch it. The conversion is a deterministic transform and nothing is stored on our side. Each API operation becomes an MCP tool:

• operationId → the tool name
• summary → the tool description (what the agent reads to decide when to call it)
• parameters + request body → the JSON-Schema inputSchema
• security scheme → the auth binding

You get back three things: the MCP tool definitions, a .well-known/mcp.json manifest, and a runnable Node MCP server built on the official @modelcontextprotocol/sdk that proxies calls through to your real API. You run that server yourself — download it, set your API base URL and (optionally) an API key, and connect it to your MCP client.

The MCP-readiness grade (A–F)

A plain converter just emits tools. This one also grades how safe your API is to hand to an agent, across seven dimensions, and shows the result as an A–F grade:

• Tool poisoning (leads the grade). Because an agent reads a tool's description verbatim, a hidden instruction smuggled into an OpenAPI summary — "ignore previous instructions", a request to read your .env, an <important> block, or invisible zero-width text — can hijack the agent that calls the tool. Every generated tool's name and description is scanned for those patterns, and a poisoning flag caps the grade so an unsafe server never reads as ready.
• Auth posture — no auth vs. static API keys vs. OAuth 2.1.
• Write surface — how many tools can modify data (POST/PUT/PATCH/DELETE).
• Untyped inputs — parameters left without a schema an agent can reason about.
• Tool count — an agent's tool selection degrades sharply past roughly 40–50 tools, so exposing hundreds of endpoints makes the server worse. The converter caps generation and warns when your API is over the limit; expose a focused set of the highest-value read and action operations instead.
• Operations missing a description are flagged (agents rely on descriptions to choose tools).

The scan is deterministic and nothing is stored.

Scope

JSON specs only for now (export or convert YAML to JSON first — YAML support is coming). The generated server is a Node stdio variant today; a Cloudflare-Worker / Streamable-HTTP variant is a fast-follow. Because the server rides the official SDK, it stays current with the protocol — including the 2026-07-28 stateless revision — by upgrading the SDK; your tool definitions do not change.

After you ship it: keep it healthy

Generating the server is the first step of a generate → validate → monitor lifecycle. Once your MCP server is live, Merlonix can monitor it: it runs a real MCP handshake (initialize + tools/list) on your check cadence and alerts you if it goes down, the handshake starts failing, latency regresses, or a tool is added, removed, or silently changes its input schema — the breaking change that quietly kills every agent calling it. See the MCP Server Health Monitoring article for how that check works.

Try it

Run the free converter at /tools/api-to-mcp on the marketing site — no signup. Then run the free MCP server health checker on your generated server, and see the Billing page for which plan keeps it monitored continuously.