Guides
From OpenAPI to a hosted MCP server: the production path
A practical walkthrough of source ingestion, tool review, authentication, deployment, and operations.
A specification is a starting point
An OpenAPI document gets you surprisingly close to an MCP server. It already describes operations, parameters, request bodies, response shapes, and often authentication. The remaining work is not a simple format conversion: it is deciding what an agent should be allowed to do and operating that contract safely.
Normalize and constrain the source
A production workflow begins by fetching the source through an SSRF-resistant client, following only safe redirects, enforcing size limits, and normalizing structured content. Generation can then map API operations into clear tools without giving the model network access to arbitrary destinations.
Review the tool contract
Human review is the critical middle step. Tool names must be stable, descriptions should explain intent, schemas need to match the actual API, and write-capable operations require an explicit decision. A generated MCP should never go directly from model output to production.
Separate runtime credentials
At deployment time, keep the tool definition immutable and inject credentials separately. Put the endpoint behind project-scoped keys, enforce resource and concurrency limits, and keep the previous healthy revision available until an update passes readiness checks.
Operate the deployed service
The final layer is operations: health probes, usage accounting, audit records, key rotation, backups, and deletion reconciliation. That is the difference between an MCP demo and an MCP service customers can depend on.