MCPmatic

OpenAPI → MCP tool definitions

Paste an OpenAPI 3.0 or 3.1 document (JSON) and get a draft tools array for your MCP server. The conversion happens in your browser. Your spec is not uploaded or stored.

How the mapping works#

OpenAPIMCP tool field
operationId (or method + path if missing)name, cleaned to the characters the spec recommends and capped at 128
summarytitle
summary + descriptiondescription
Path, query and header parametersProperties of inputSchema; path parameters are always required
JSON requestBodyAn inputSchema property called body
Local $refs (#/components/...)Inlined; recursive references are stopped after one level
HTTP methodSuggested annotations (see below)

Suggested annotations by method#

These are MCPmatic's defaults, not rules from either spec. Check each one, especially for POST.

MethodreadOnlyHintdestructiveHintidempotentHint
GET, HEAD, OPTIONStrue(not meaningful)(not meaningful)
POSTfalsefalse (review)false (review)
PUTfalsetruetrue
PATCHfalsetruefalse
DELETEfalsetruetrue

openWorldHint is set to true for every tool, because an HTTP API is an external system. See tool annotations explained.

What it deliberately leaves out#

This produces tool definitions. You still need a server that implements tools/call for each one, using an official SDK (TypeScript, Python, Go and C# are the Tier 1 SDKs for 2026-07-28, per the MCP blog). Start from the MCP server examples.

Frequently asked questions#

Does the converter upload my OpenAPI spec?

No. The conversion runs in your browser and nothing is sent to a server. You can disconnect from the network after the page loads and it still works.

Can I paste YAML or Swagger 2.0?

Not yet. Paste OpenAPI 3.0 or 3.1 as JSON. Convert YAML to JSON in your editor first, and convert Swagger 2.0 documents to OpenAPI 3 before pasting.

Does this generate a working MCP server?

No. It produces tool definitions (the tools array). You still implement tools/call for each tool with an official SDK. See MCP server examples.

Why are Authorization headers dropped?

Credentials don't belong in arguments the model fills in. Your server should read API keys from its own environment or auth layer. See the security best practices.

Sources#