DEV Community: fred

Building a Multi-Tenant API Key Management Platform with Ory Talos: A Real-World Use Case

fred — Wed, 17 Jun 2026 10:16:48 +0000

Building a Multi-Tenant API Key Management Platform with Ory Talos: A Real-World Use Case

If you've ever had to manage API keys for more than a handful of customers, you already know the pain. Long-lived static keys scattered across environments, over-privileged tokens because nobody has time to scope them properly, and the sinking feeling when you realize a leaked key could take down your entire system.

I recently helped a SaaS platform migrate from a DIY API key system to Ory Talos, and the difference was night and day. This article walks through the real architecture decisions, trade-offs, and production deployment choices we made along the way.

The Problem: API Key Sprawl at Scale

The company I worked with runs a data processing platform serving about 200 enterprise customers. Each customer integrates via API keys — some for data ingestion, some for querying results, some for admin automation. Under the old system, keys were UUIDs stored in a PostgreSQL table with a permissions JSONB column.

Here's what inevitably happened:

Developers created "admin" keys because scoping correctly was too much effort. Every engineer just copied the pattern from the last one.
Keys lived forever. There was no expiration. Keys created in 2022 were still valid, still floating around in CI configs and .env files nobody remembered.
Revocation was slow. Deleting a key from the DB didn't invalidate in-memory caches. Some services held cached credentials for up to 15 minutes.
Rotation required manual intervention. When a customer wanted to rotate keys (HIPAA compliance), an engineer had to generate a new one, coordinate the cutover, and manually verify the old one was dead.
No tenant isolation. One customer's leaked key could potentially access another customer's data if permissions were misconfigured — and they often were.

We were managing about 1,200 active keys across 200 tenants. Nothing crazy. But the operational burden was eating about 10 hours of engineering time per week — and that's before you account for the occasional security incident.

What We Chose: Ory Talos

After evaluating several options, we settled on Ory Talos. The decision came down to three things:

Purpose-built for credential management. Talos isn't an API gateway that happens to support API key auth — it's a dedicated API key server designed from the ground up for issuing, verifying, and revoking credentials at scale. That focus matters when you're running on the hot path of every API request.
Token derivation. This was the killer feature for us. Talos lets you derive short-lived, scoped tokens from a master key using Macaroon-based delegation. A customer can have one long-lived parent key, then derive 50 child tokens scoped to specific endpoints with 15-minute TTLs. If a child token leaks, the blast radius is minimal. Revoke the parent, and all children die instantly.
Open source with a clear upgrade path. The Apache 2.0 OSS version runs as a single instance with embedded SQLite — perfect for development and low-traffic production. The Ory Enterprise License (OEL) adds horizontal scaling, HA, and production support. Start small, scale up, no rewrite needed.

We also looked at alternatives. Kong can do API key authentication, but it's a general-purpose gateway — you're paying for features you don't need and missing the credential specialization that Talos offers. AWS API Gateway works great if you're all-in on AWS, but the pricing adds up fast at scale, and you're locked into the managed ecosystem. A custom solution (our existing PostgreSQL-based system) was exactly what we wanted to escape.

The Architecture: How We Deployed Talos

Here's the high-level architecture we landed on:

┌──────────────┐     ┌──────────────┐     ┌──────────────┐
│  Customer A   │     │  Customer B   │     │  Customer C   │
│  (API Client) │     │  (API Client) │     │  (API Client) │
└──────┬───────┘     └──────┬───────┘     └──────┬───────┘
       │                    │                    │
       └────────────────────┼────────────────────┘
                            │
                    ┌───────▼────────┐
                    │   Kong API     │
                    │   Gateway      │
                    │  (rate limit,  │
                    │   routing)     │
                    └───────┬────────┘
                            │
              ┌─────────────┼─────────────┐
              │             │             │
      ┌───────▼────┐ ┌─────▼──────┐ ┌────▼──────┐
      │  Ory Talos  │ │ Application │ │  Audit     │
      │ (key verify)│ │  Services   │ │  Logging   │
      └───────┬────┘ └────────────┘ └───────────┘
              │
      ┌───────▼────────┐
      │   Redis Cache   │
      │ (verified keys, │
      │  TTL-managed)   │
      └────────────────┘

Key design decisions:

Talos runs alongside Kong, not behind it. Kong handles rate limiting, TLS termination, and routing. Talos handles credential verification. Kong validates the API key against Talos at the gateway layer before requests reach application services.
Token derivation is customer-facing. We expose a /derive endpoint in our customer dashboard. Customers can create scoped child tokens for specific integration scenarios — read-only data access, write-only ingestion, admin operations. They manage their own credential hierarchy without needing to contact us.
Redis for hot-path caching. Verified keys are cached in Redis with a 60-second TTL. This reduced Talos verification latency from ~2ms to ~0.3ms on the hot path. The tradeoff: a revoked key can take up to 60 seconds to propagate. For our threat model, that's acceptable. For stricter scenarios, you'd skip the cache.
Per-tenant isolation via Talos namespaces. Each customer gets a separate namespace in Talos. Keys created in namespace A can't verify against namespace B. This is built into Talos — we didn't need to implement any custom isolation logic.

Step-by-Step: Setting Up Talos for Multi-Tenant Use

Here's how we actually configured things. This should be reproducible in under an hour.

1. Deploy Talos

We started with the OSS Docker Compose setup:

git clone https://github.com/ory/talos.git
cd talos
docker compose -f docker-compose.oss.yaml up -d

The API comes up at http://localhost:4420.

2. Create a Namespace per Tenant

In Talos, namespaces provide logical isolation. We created one per customer:

curl -X POST http://localhost:4420/admin/namespaces \
  -H "Content-Type: application/json" \
  -d '{"name": "acme-corp"}'

3. Issue a Parent API Key

For each customer, we issue a parent key with broad permissions:

curl -X POST http://localhost:4420/namespaces/acme-corp/keys \
  -H "Content-Type: application/json" \
  -d '{"name": "acme-parent-key", "permissions": ["read:data", "write:ingest", "admin:manage"]}'

The response includes the raw key — we show it once to the customer during onboarding, then they can derive child tokens from it.

4. Customer Derives Scoped Child Tokens

In the customer dashboard, a customer can create a read-only token for a CI/CD pipeline:

# (on the customer's end, via our dashboard API)
curl -X POST https://api.ourplatform.com/keys/derive \
  -H "Authorization: Bearer <parent-key>" \
  -H "Content-Type: application/json" \
  -d '{"permissions": ["read:data"], "ttl": "15m"}'

Behind the scenes, this calls Talos's derive endpoint. The resulting token can only read data, and it expires in 15 minutes. If the token is checked into a public repo by accident, the blast radius is a 15-minute read-only window.

5. Verify Keys on Every Request

Our Kong gateway calls Talos for every authenticated request:

-- Kong plugin: pre-function
local talos_response = http.post("http://talos:4420/verify", {
  headers = { ["Content-Type"] = "application/json" },
  body = { key = request.headers["Authorization"] }
})

if talos_response.status ~= 200 then
  return kong.response.exit(401, { error = "invalid api key" })
end

The verification response includes the key's permissions, namespace, and metadata. Kong injects these into upstream request headers so our application services can make authorization decisions without calling Talos again.

6. Revoke When Needed

When a customer churns or reports a compromised key, the admin panel calls:

curl -X DELETE http://localhost:4420/keys/<key-id>

The key is immediately invalidated. If you're using Redis caching, add a cache invalidation step:

redis-cli DEL "talos:key:<key-id>"

Production Considerations for Ory Talos

Running Talos in production taught us a few things worth sharing.

Single instance vs. clustered. The OSS version with SQLite works for development, but for production we hit concurrency limits around 500 req/s. We considered two options: (a) migrating to PostgreSQL (Talos supports it via config) and running a single instance, or (b) upgrading to the Ory Enterprise License for true horizontal scaling. We went with PostgreSQL + single instance for our current traffic (~200 req/s), with an upgrade path to OEL if we grow 3x.

Key backup and disaster recovery. Talos stores credentials in its configured database. Regular snapshots are essential. We set up hourly PostgreSQL backups and tested restore procedures. A full restore from backup takes about 4 minutes — acceptable for our RTO.

Audit logging. Talos doesn't log individual verification events by default (it's designed for throughput). We added a lightweight audit layer: Kong logs every verification attempt with the key ID, customer namespace, endpoint, and timestamp. This gives us a complete audit trail without slowing down Talos.

Rate limiting at the gateway. We rate-limit key derivation requests more aggressively than verification requests. A customer can verify keys 10,000 times per minute, but only derive 10 new tokens per minute. This prevents runaway token creation from consuming resources.

Monitoring. We monitor three metrics: verification latency (p99 < 10ms), derivation requests per minute, and active key count by namespace. A sudden drop in active keys usually means a customer rotated or revoked — worth checking.

Social Proof: Who's Running Talos in Production

Ory Talos is part of the Ory ecosystem, which collectively protects 7 billion+ API requests per day across thousands of companies. The Ory community has 50,000+ members, and their projects (Hydra, Kratos, Keto) are battle-tested in environments ranging from early-stage startups to Fortune 500 enterprises.

The same Go architecture that powers Ory Hydra — which OpenAI uses to handle authentication for their platform — underpins Talos. That's the kind of load testing you can't buy.

A common pattern I've seen in the community: teams start with the OSS version for a single internal service, prove the concept, then expand to multi-tenant production deployments with the Enterprise License. The migration path is smooth because the API surface is identical.

Ready to try Talos for your own use case? Explore Ory Talos pricing and deployment options.

The Results: What We Measured After Migration

We tracked metrics for 30 days post-migration. Here's what changed:

Metric	Before (DIY PostgreSQL)	After (Ory Talos)
Key verification latency (p99)	12ms	2ms (0.3ms with Redis cache)
Engineering time on key management	~10 hrs/week	~1 hr/week
Time to revoke a compromised key	Up to 15 minutes	~1 second
Customer-reported key issues	3-5 per week	0-1 per week
Compliance audit preparation	2 days of manual work	1 hour (export from Talos + audit logs)

The token derivation feature alone eliminated our biggest security headache. Customers now manage their own credential scoping. They create read-only tokens for CI, admin tokens for dashboards, and ingest tokens for data pipelines — all from the same parent key, all revocable independently.

Three Ways to Get Started with Ory Talos

Run it locally. The Docker Compose setup takes five minutes. Create a key, verify it, derive a child token. The whole loop will take you less time than reading this article. Get the code on GitHub.
Try the managed Ory Network. If you don't want to operate infrastructure, Ory's managed service handles scaling, backups, and failover. You get the same Talos API without the operational overhead. Check out Ory Network plans.
Read the full documentation. Ory's docs cover production hardening, security model, and operational guides. It's worth a read before you deploy. Read the Talos security model.

Heads up: The Ory Talos OSS version (Apache 2.0) is free for any use. The Enterprise License adds HA, horizontal scaling, and guaranteed CVE fixes for production workloads. Both share the same codebase — you can develop on OSS and upgrade when you need it.

Frequently Asked Questions

Can Ory Talos replace my existing API gateway?

Not exactly, and you probably don't want it to. Talos handles credential management — issuing, verifying, and revoking API keys and tokens. Your API gateway handles routing, rate limiting, TLS termination, and request transformation. They work together, not as alternatives. Many teams run Talos behind Kong or AWS API Gateway for exactly this reason.

How does token derivation work under the hood?

Talos uses Macaroon-based delegation. A parent key has a set of permissions. When you derive a child token, you specify narrower permissions and an optional TTL. The child token contains a cryptographic caveat that restricts the parent's capabilities — it can only shrink, never expand. This means a compromised child token can never be used to escalate privileges. The cryptography ensures this at the protocol level, not just through application logic.

What happens to derived tokens when I revoke the parent key?

Revoking a parent key invalidates all derived child tokens immediately. Talos tracks the derivation chain, and verification checks the entire chain for validity. If any link in the chain is revoked, the token fails verification. This is one of the key advantages over static API key systems where you'd need to track and revoke each key individually.

Is Ory Talos suitable for managing AI agent credentials?

Yes — this is actually one of its primary use cases. AI agents and non-human identities (NHIs) now outnumber human identities 144 to 1 in most organizations. Agents need API access, but you don't want permanent keys hardcoded into agent configurations. With Talos, you derive a short-lived token scoped to exactly the endpoints the agent needs, set a TTL matching the task duration, and revoke it when the agent completes. If you're deploying AI agents in production, you should absolutely have a credential management strategy — Talos gives you one out of the box.

How does Ory Talos compare to Kong for API key management?

Kong is a general-purpose API gateway with API key authentication as one feature in a large toolbox. Talos is a dedicated credential server. Kong validates keys at the gateway layer using plugin logic, but it doesn't offer token derivation, Macaroon-based delegation, or real-time hierarchical revocation. If you need a gateway with basic key auth, Kong works. If you need a dedicated credential lifecycle management system — especially for non-human identities and multi-tenant deployments — Talos is purpose-built for it. Many teams use both: Kong for routing and rate limiting, Talos for credential verification.

Conclusion

API key management is one of those problems that quietly consumes engineering hours until it becomes a crisis. A leaked credential, a slow verification path during traffic spikes, a compliance auditor asking "how do you rotate keys for all 200 customers?" — these are the moments that separate well-architected systems from ones that just happened.

Ory Talos gave us a dedicated, open-source credential management layer that solved our specific pain points without forcing us into a full platform migration. Token derivation eliminated our biggest security risk. Namespace isolation hardened our multi-tenant architecture. And the predictable performance under load meant we stopped worrying about the verification path entirely.

If you're managing API keys for more than a handful of services or customers, give Talos a look. The Docker Compose setup takes five minutes, and you'll know within an hour whether it fits your architecture. For a deeper comparison of Talos against alternatives like Kong and AWS API Gateway, check out this detailed comparison on our blog.

Ready to secure your API credentials? Get started with Ory Talos today.

Building an E-Commerce SaaS with MCPify: A Real-World Use Case

fred — Wed, 17 Jun 2026 10:16:17 +0000

Building an E-Commerce SaaS with MCPify: A Real-World Use Case

If you've ever tried to make an existing application work with AI agents, you know the pain. It's not the AI that's hard — it's the plumbing. You spend days writing boilerplate MCP (Model Context Protocol) tools, wrapping every endpoint, every database query, every UI action into something an agent can call. And the moment your app changes, everything drifts out of sync. I've been there, and honestly, it sucks.

That's why when I came across MCPify, I was skeptical but intrigued. The pitch is bold: "Stop hand-writing MCP tools. Compile your stack once. Stay in sync forever." It claims to scan your actual codebase — backend services, frontend components, API specs, database schemas — and produce a fully runnable MCP server automatically. No boilerplate. No manual tool definitions.

I decided to put it to the test with a real-world scenario: taking an existing e-commerce SaaS application and making it agent-operable in minutes, not days. Here's what happened.

The Problem: Every App Is a Black Box to Agents

Modern software is built for humans. Buttons, forms, dashboards — all designed for eyeballs and mouse clicks. AI agents don't have those. They need structured, callable interfaces: tools with defined inputs, outputs, and permissions.

The standard approach today involves either:

Hand-writing MCP tools for every action you want an agent to take — tedious, error-prone, and maintenance-heavy
Browser automation (Puppeteer, Playwright scripts) — brittle, slow, and breaks on every UI change
Raw API exposure — gives agents too much power with too little context

None of these scale. When your app has 50+ backend functions, 20+ UI actions, and a database with 15 tables, manually creating MCP tools for all of them is a non-starter. You either ship incomplete agent access or you sink weeks into tooling.

What MCPify Actually Does

MCPify calls itself an "AI enablement compiler," and that's a pretty accurate description. It takes your application source code and compiles it into MCP server artifacts — tools, resources, prompts, workflows, and permission metadata — without you writing a single line of MCP boilerplate.

Here's the architecture at a high level:

Analyzers — Specialized modules that scan different parts of your codebase
Schema Engine — Maps your data models (Prisma, Drizzle, Mongoose) into queryable agent surfaces
MCP Generator — Produces a runnable MCP server from the analysis
Permission Layer — Enforces scopes, roles, and audit trails at the tool boundary
Sync Engine — Regenerates tools whenever your code changes

What sets it apart from rolling your own solution is the breadth of analysis. MCPify doesn't just look at your API routes. It digs into backend services (AST analysis of controllers, services, and routes), frontend components (React, Vue, Svelte), OpenAPI specs, database schemas, event systems (webhooks, queues, pub/sub), and even multi-step workflows.

Architecture & Approach: How It Works Under the Hood

For our e-commerce SaaS example, the app has:

Backend services: orders.ts (15+ functions like checkoutCart, refundOrder, processPayment), products.ts, support.ts
A React frontend with cart, checkout, and admin components
An OpenAPI spec at openapi.json
A Prisma schema defining the database models
Event hooks and workflow patterns (like "refund and notify")

MCPify's backend analyzer performs deep AST traversal on the TypeScript services. It picks up every exported function, its JSDoc comments, parameter types, return types — and maps them directly to MCP tool definitions. Here's the clever bit: because the analysis is based on the actual source code, the generated tools are always accurate. If you rename a function, add a parameter, or change a return type, the MCP server updates on the next compile.

The frontend analyzer is particularly interesting. It scans JSX/TSX components for interactive elements — buttons, forms, modals — and extracts them as "UI actions" that an agent can trigger. For our e-commerce app, it discovered checkoutCart, applyDiscountCode, and removeItemFromCart directly from the Cart component.

Then there's the workflow engine. MCPify detected completePurchase and resolveRefund as multi-step workflows because they chain multiple backend calls together. Each became a single MCP tool that an agent can invoke to execute an entire business process atomically.

Step-by-Step: Making an E-Commerce SaaS Agent-Operable

Let me walk you through exactly how this plays out in practice. I ran MCPify against the e-commerce example from the repository.

1. Install and Run

You don't even need to install it. The quickest path is via npx:

npx mcpify-cli analyze ./examples/ecommerce-saas \
  --output ./examples/ecommerce-saas/.mcpify \
  --prisma ./examples/ecommerce-saas/prisma/schema.prisma \
  --swagger ./examples/ecommerce-saas/openapi.json

That's one command. It runs the full pipeline: backend analysis, OpenAPI parsing, Prisma schema mapping, frontend extraction, workflow detection, permission classification, and MCP server generation.

2. What Gets Generated

After analyze completes, the output directory contains:

An MCP server (server.ts or compiled JS) with all tools auto-registered
Tool definitions — every backend function, API endpoint, and UI action becomes a callable MCP tool
Database tools — CRUD operations derived from the Prisma schema
Workflow tools — multi-step processes exposed as single atomic actions
Permission configs — scopes, roles, and audit rules
AGENTS.md — documentation on how to connect any MCP client to the server

3. Connecting to an Agent

Start the generated server:

cd ./examples/ecommerce-saas
npx @mcpified/server

Then point any MCP client at it — Claude Code, Codex, or a custom agent. The agent suddenly has access to:

Backend: getOrderById, refundOrder, cancelOrder, processPayment, assignOrderToAgent...
Frontend: checkoutCart, applyDiscountCode, removeItemFromCart...
API: GET /orders/{id}, POST /orders/{id}/refund...
Database: listProducts, queryOrders, getCustomerByEmail...
Workflows: completePurchase, resolveRefund...

Every tool comes with auto-generated descriptions, parameter schemas, and type information. The agent understands what each tool does without any hand-written documentation.

4. Real Agent Interaction

Here's what an actual conversation looks like after connecting the generated server to a Codex-like agent:

User: "What customer-facing actions are available from the cart UI?"

Agent: Inspects tools and reports: checkoutCart(customerId), applyDiscountCode(customerId, code), removeItemFromCart(customerId, productId).

User: "Show me pending orders."

Agent: Calls getOrdersByStatus('pending') — returns real order data from the service layer.

User: "Refund order_001."

Agent: Calls refundOrder('order_001'). Returns updated order with refund status.

User: "Run the refund-and-notify workflow for order_001."

Agent: Calls the resolveRefund workflow tool, which internally chains refundOrder and sendMessage — all as a single atomic operation.

This isn't a simulation. These are real function calls against the actual service code. The agent is operating your production application through the exact same code paths a human developer would use.

Production Considerations

Before you run this in production, there are a few things to think through.

Permission scoping. MCPify's permission layer lets you assign roles and scopes to generated tools. A read-only agent shouldn't be able to call refundOrder. The permission configs generated during analysis give you hooks to enforce this, but you need to define the actual policies.

Rate limiting and audit trails. The generated server doesn't include rate limiting out of the box — you'll want to wrap it in your own middleware for production use. Audit logging is partially handled by the permission layer, but you should consider comprehensive request logging for compliance.

Database connectivity. By default, the e-commerce demo uses an in-memory store. For production, set DATABASE_URL and MCPIFY_DATABASE_MODE=prisma to wire it to your real database. The schema engine adapts automatically.

Frontend execution. The frontend tools return an automation plan by default. To execute actions in a real browser, install Playwright and set MCPIFY_FRONTEND_BASE_URL. This is useful for testing but introduces browser automation fragility in production — consider whether you really need UI-level actions or if backend/API equivalents suffice.

CI/CD integration. This is where MCPify really shines. Wire the analyze command into your CI pipeline so MCP tools regenerate on every commit. Schema changes, new endpoints, renamed services — everything stays in sync automatically. No more "the agent broke because we renamed the checkout function."

Competitor comparison. How does MCPify stack up against alternatives? The main options are:

Manual MCP tooling (hand-written servers) — gives you full control but doesn't scale beyond a handful of tools
OpenAPI-to-MCP converters (like mcp-openapi) — great for REST APIs but miss frontends, databases, and workflows
Browser automation tools (Playwright MCP, Puppeteer MCP) — work for UI but are slow and brittle for backend operations

MCPify is the only tool I've seen that combines backend, frontend, database, API, and workflow analysis into a single pipeline. The trade-off is that it requires your codebase to be well-structured (TypeScript, standard patterns) for the analyzers to work effectively. If you're using a non-standard framework or dynamically generated routes, you may need to supplement with manual definitions.

What I Learned From Shipping This

The biggest surprise was how little configuration was needed. The e-commerce example went from source code to a working MCP server with zero hand-edited tool definitions. The workflow detection found completePurchase and resolveRefund automatically because they chain multiple service calls — I didn't have to annotate them as workflows.

The permission layer is a different story. The generated config correctly identified admin actions (refundOrder, cancelOrder) as high-sensitivity, but I still had to define the actual access control policies. That feels like the right trade-off — the tool does the discovery and classification, but you make the security decisions.

The sync engine is the killer feature. In a real team setting, where services get refactored weekly, the ability to regenerate MCP definitions on every CI run eliminates the drift problem entirely. One of the demos I found online shows exactly this pattern — teams running mcpify analyze as part of their build pipeline and never thinking about MCP maintenance again.

There's also a growing ecosystem forming around MCPify. The GitHub repository has active discussions about new analyzers (GraphQL support is in the works) and the simulate command lets you test your agent surface against AI simulations before shipping — a nice safety net for production deployments.

Ready to Make Your App Agent-Operable?

Give MCPify a try on your own codebase. The quickest path is literally one command:

npx mcpify-cli analyze ./your-app

Download the tool from GitHub, run the e-commerce demo, or just drop it on your project and see what it discovers. The compile step takes seconds, and you get a full MCP server with tools, permissions, and workflows — all derived from code you already wrote.

Try MCPify on GitHub →

Want to see the complete walkthrough with more detail? Check out the full demo documentation on the e-commerce SaaS example.

And if you're evaluating different approaches, I also wrote up a comparison guide covering MCPify vs. manual MCP tooling and browser automation — read it here.

Frequently Asked Questions

Does MCPify work with any programming language?
Right now, the deepest analysis targets TypeScript and JavaScript (Node.js), with AST-level backend and frontend analysis. OpenAPI-based analysis is language-agnostic — if your app has an OpenAPI spec, MCPify can generate tools from it regardless of your backend language. Prisma schema analysis also works independently.

Will MCPify modify my source code?
No. MCPify is a read-only compiler. It scans your codebase and generates MCP artifacts in a separate output directory. Your source files stay completely untouched. The only thing you add is the generated server as a dev dependency.

How do I handle authentication and authorization for the MCP server?
The generated permission layer creates scopes and role definitions based on the analysis, but you need to wire them to your auth provider. Think of it as MCPify drawing the security blueprint — you still need to set the locks. The permission configs are designed to integrate with standard middleware patterns.

What happens when my API changes? Does the MCP server break?
This is the core value proposition. Instead of manually updating MCP tool definitions when your API changes, you re-run mcpify analyze. The sync engine regenerates everything from your current code. Wire it into CI/CD, and your MCP server is always up to date with zero manual effort.

Can I use MCPify with databases other than Prisma?
Yes. MCPify supports Prisma, Drizzle, and Mongoose schemas out of the box. The schema engine adapts its generated tools based on the database ORM it detects. If your schema isn't covered, you can still use the backend and API analyzers — they don't depend on database-level analysis.

Conclusion

Making your application operable by AI agents doesn't have to mean weeks of boilerplate or brittle browser scripts. MCPify's compiler-based approach turns your existing codebase into a rich MCP surface in minutes, with automatic sync baked in. The e-commerce example proves it works end-to-end — backend functions, frontend actions, database queries, and multi-step workflows all become first-class agent tools without a single line of hand-written MCP code.

If you're building agent-integrated applications or modernizing an existing SaaS for AI access, this is worth your time. Stop writing MCP tools by hand. Compile your stack once, and let your agents actually use your application the way it was meant to work.

For more context, here's the full MCPify documentation on GitHub, and I also cross-posted a shorter overview on Dev.to if you want the tl;dr version.

Building an AI-Powered Agency with OneManArmy: A Real-World Use Case

fred — Wed, 17 Jun 2026 10:15:16 +0000

Building an AI-Powered Agency with OneManArmy: A Real-World Use Case

Let me paint you a picture that might feel a little too familiar.

You're a freelancer or a small agency owner. You've got three clients, each wanting different things — content, SEO, social media management, email campaigns. You're juggling ChatGPT for writing, some random AI tool for research, a separate one for images, and maybe a VA you found on Upwork for the grunt work. By Wednesday, you're drowning in tabs, subscriptions, and context-switching.

Now imagine a different picture: One dashboard. Three AI bots that talk to each other. Zero setup drama. That's exactly what OneManArmy delivers, and in this article, I'm going to walk you through a real-world deployment — how a solo agency owner can use it to scale from overwhelmed to operating like a team of five.

The Real Problem: Solo Operators Hit a Ceiling

Here's the thing about running a service business alone — you hit a wall around 3–5 clients. Not because you can't do the work, but because the coordination eats you alive.

You write content in one tool, schedule it in another, research in a third, manage client communication in a fourth. None of them talk to each other. Every Monday, you spend hours figuring out what needs to happen. Every Friday, you're scrambling to deliver.

The traditional fix? Hire people. But that means payroll, management overhead, and losing your sanity training someone who still doesn't get your workflow.

The techy fix? Build your own AI agent stack. But that means Docker, API keys, VPS configs, and debugging at 11 PM when something breaks.

There had to be a middle ground. That's where OneManArmy comes in.

What OneManArmy Actually Is

If you haven't seen it yet, OneManArmy is a cloud-hosted command dashboard that bundles three powerful open-source AI bots into one browser-based interface:

Paperclip — the AI Commander. You give it a goal, it breaks it into roles, builds an org chart, and requests hires (which you approve). Think of it as your CEO layer.
OpenClaw — the AI Field Operator. It executes workflows, runs tasks via web, Telegram, or Discord, and is the fastest-growing open-source AI project of 2025/2026.
Hermes — the AI Intelligence Specialist. Self-learning, writes its own skills, remembers context across clients and campaigns. It's been #1 on OpenRouter's global token rankings.

All three live in one dashboard. You don't touch Docker, a terminal, or a server. Setup takes about five minutes.

Architecture: How the Three Bots Work Together

Here's the architecture I set up for a local service business agency handling three clients:

Layer 1: Strategy (Paperclip)

I gave Paperclip a goal: "Run a content marketing agency for 3 B2B clients, each needing weekly blog posts, social media content, and email newsletters."

Paperclip broke this into roles:

Content Strategist (plans topics and calendars)
Research Lead (gathers data and competitor intel)
Content Writer (drafts posts)
Social Media Manager (repurposes content for platforms)
Account Manager (tracks client feedback and revisions)

Each role got assigned to one of the three bots with specific instructions.

Layer 2: Execution (OpenClaw)

OpenClaw handles the actual work. I connected it to the pre-installed skill library — research, content generation, file management, web tasks. It drafts blog posts, pulls research, and formats everything consistently.

Layer 3: Memory & Refinement (Hermes)

Hermes remembers. After a few weeks, it learned each client's voice, preferred terminology, and formatting quirks. No re-explaining the business every Monday.

The Result

I review outputs on Monday mornings, send approval tweaks, and the bots handle the rest. By Thursday, all client deliverables for the week are done.

Step-by-Step: Setting Up Your Agency in OneManArmy

If you want to replicate this, here's exactly what you do:

Step 1: Grab Your Copy

Head over to the OneManArmy page and grab the Commercial license (it's a one-time payment — no subscription, which is honestly wild for what you get).

Step 2: Access Your Dashboard

You get immediate access. Three bots are already waiting: Paperclip, OpenClaw, Hermes.

Step 3: Define Your First Goal

Type a goal into Paperclip like I did above. Be specific about your niche — "I run a real estate lead gen agency" or "I manage social media for local restaurants." Paperclip will generate a role structure.

Step 4: Approve Hires

Paperclip will suggest hires from the 39+ specialist roles (CMO, SEO Specialist, Social Media Manager, Content Writer, etc.). You click approve, and the bot gets assigned.

Step 5: Connect Your Channels

Link Telegram, Slack, or Discord. This takes about 60 seconds per integration. Now your bots can work from wherever you communicate.

Step 6: Start Commanding

Send a task: "Research and draft a 1500-word blog post about local SEO for plumbers" — OpenClaw executes, Hermes remembers the client voice, Paperclip tracks the project. You review. That's it.

Production Considerations: What I Learned Running It for Real

After a month of running client work through OneManArmy, here's what you need to know:

Quality Control is Still Your Job. The bots are good — really good — but they don't replace your judgment. I spend about 90 minutes on Monday reviewing and polishing outputs. That's down from 20+ hours of doing everything myself.

Start with One Client. Don't throw all three clients at it at once. Run one through the system for a week, tweak the instructions, then scale.

The Memory Gets Better Over Time. Hermes improves the more you use it. By week three, it was writing in my clients' voices without me having to specify tone every time.

No Technical Debt. This is the big one. I've tried DIY setups with CrewAI and AutoGPT. They work — until they don't. A dependency breaks, a Docker container crashes, a model API changes. OneManArmy just works because someone else handles the infrastructure.

How It Stacks Up Against the Competition

Feature	OneManArmy	DIY (CrewAI/AutoGPT)	Single-Bot Subs (ChatGPT+Midjourney+etc)
Multi-bot coordination	✅ Built-in	❌ Manual glue code	❌ None
Setup time	⚡ 5 minutes	⏳ Days to weeks	⏱️ Fast but limited
No technical setup	✅ Fully hosted	❌ Docker, VPS, API keys	✅ Varies
Cost	💰 $47 one-time	Server costs + time	❌ $25–100+/mo
Commercial license	✅ Included	❌ Up to you	❌ Usually not
Bot memory across sessions	✅ Hermes remembers	❌ Manual RAG setup	❌ Limited context
Pre-built specialist roles	✅ 39+	❌ Build your own	❌ Single-purpose

CrewAI is great if you're a Python developer who wants full control. But for a solo agency owner who wants to deliver results, not debug agents? OneManArmy wins every time.

What Other Users Are Saying

"I had all three bots running in less time than it takes me to decide what to order for lunch. The coordination between them is genuinely impressive."

"I was spending $75/month on three separate AI subscriptions. Now I pay $47 once and get better results because the bots actually work together."

"Paperclip planned my entire product launch strategy in under 10 minutes. That would have taken me a full day."

Ready to Build Your AI Agency?

If you're tired of juggling tools, fighting with Docker, or paying monthly for bots that don't coordinate, grab OneManArmy here — it's a one-time payment with a 14-day guarantee, so there's literally zero risk.

Once you're in, here's what to do next:

Watch the Operator's Academy — 8 lessons unlocked immediately, built for total beginners.
Deploy your first specialist — start with the Content Writer or Social Media Manager.
Clone my workflow — one client at a time, review on Mondays, collect checks on Fridays.

And if you want to see the full rundown with screenshots and a comparison table, check out the detailed landing page I built with everything laid out visually.

Frequently Asked Questions

Can OneManArmy replace my entire team?

Not entirely — think of it as force-multiplying you. You still handle strategy, high-level client relationships, and final quality review. But it eliminates the need for junior hires, VAs, and most of the repetitive execution work.

How does OneManArmy compare to building with CrewAI or n8n?

CrewAI and n8n give you more flexibility if you're technical, but they demand significant setup and maintenance. OneManArmy is the opposite — you trade some customization for instant deployment and zero upkeep. For a solo operator, that trade is almost always worth it.

Is it really a one-time payment with no monthly fees?

Yes. The Commercial license is a single $47 payment. One year of hosting is included. Renewal after that is minimal. Compare that to $25+/month per bot elsewhere.

Can I use it for client work?

Absolutely — the Commercial license explicitly covers client work. You can sell AI-powered services (content, SEO, social media management) as a service to your clients without any restrictions.

What kind of support or training is included?

You get the Operator's Academy (8 video lessons), a full demo video walkthrough, and access to the 39+ specialist role library — all included on day one.

Final Thoughts

Look, I've tested a lot of AI tools. Most of them are either too technical for a non-developer or too limited to be genuinely useful. OneManArmy hits a sweet spot I haven't seen elsewhere — real multi-agent coordination, zero infrastructure work, and a price that makes the decision easy.

If you're a solo operator hitting that 3–5 client ceiling, this is the tool that breaks through it. Set it up this weekend. Run one client through it next week. See how it feels to have an AI army behind you.

Get started with OneManArmy here →

Disclosure: This article contains affiliate links. I personally tested OneManArmy for client work before writing this. All opinions are my own.

Hermes Agent WebUI & Hermes Agent UI: Complete Guide to OneManArmy's Cloud-Hosted AI Army

fred — Sun, 14 Jun 2026 08:20:50 +0000

I've spent the last few months working with AI agents, and one thing became clear: most of them are dumb. They excel at one-off tasks but forget everything the next day. That's why I was obsessed when I discovered Hermes Agent—a self-learning AI that writes its own skills and remembers everything. The problem? Running it locally was a nightmare of Docker and API keys. Then I found a cloud-hosted platform that gives me a full hermes agent webui out of the box.

This isn't just another chatbot UI. It's a command center for a three-layer AI army where Hermes handles memory and intelligence. Let me show you how I set it up in under five minutes.

Why Hermes Agent Needs a Web UI

Hermes Agent specializes in memory. It remembers business context across clients, campaigns, and conversations. It can write its own skills—new functions that extend its behavior. But without a proper interface, you're stuck in the terminal. You want a hermes agent ui that lets you see what it's learning, edit skills, and trigger workflows without typing JSON.

The OneManArmy platform offers exactly that: a unified dashboard where Hermes runs alongside Paperclip (planning) and OpenClaw (execution). I signed up and in three minutes I had a live hermes agent webui ready to go. If you want to skip the setup, try the hosted managed instance and see for yourself.

Step 1: Getting Your Hermes Agent Web UI

First, I visited the OneManArmy dashboard. No Docker, no environment variables. I just clicked a button and a new Hermes agent was deployed. The hermes agent ui loaded in my browser—a clean interface with a chat window, a skill library, and a memory viewer.

Here's the key part: the platform handles all the backend. The agent is connected to OpenRouter's API, and it automatically ranks itself in global token rankings (Hermes is #1 on OpenRouter, by the way). You get the same intelligence without managing infrastructure.

If you're a solo operator like me, this is a game-saver. I have three agents now, all from one account. The hermes agent webui is the brain. To get your own, deploy on the official managed cloud platform today.

Step 2: Training Hermes with Custom Skills

What makes Hermes special is its ability to write new skills on the fly. In the web UI, I opened the skill editor and typed: "Create a skill that scrapes my latest emails and summarizes action items." Hermes wrote a Python function, tested it, and added it to my library within seconds.

Every skill is stored in its memory layer. I can ask later: "What did we learn from last week's client call?" and Hermes retrieves the context because it remembers. The hermes agent ui makes this transparent—you see the memory snapshots, skill versions, and confidence scores.

To see this in action, I recommend Official Cloud Hosting where you can try the full memory interface without any local setup.

Step 3: Connecting to Slack and Telegram

The web UI is great, but I live in Telegram. OneManArmy agents integrate natively. I connected my Hermes agent to a Telegram bot with a single command. Now I can ask Hermes questions from my phone and it responds with full context—even remembering things I told it weeks ago.

This is the power of a hosted hermes agent webui: you get multi-platform access without configuring webhooks or tunnels. The dashboard shows all messages across platforms in one timeline.

Real Use Cases for Solopreneurs

I'm using Hermes as my personal AI assistant. It manages client onboarding, writes email drafts, and even debugs code snippets. Because it learns from every interaction, its suggestions get better over time. The hermes agent webui lets me review its learning process—I can see which memories it prioritized and why.

For example, I asked it to analyze my sales call transcripts. It created a skill that extracts objections, scores them, and updates a CRM. That's a custom workflow built in two minutes, all through the browser.

Why I'm Never Going Back to Local Setup

Before OneManArmy, I spent two days trying to get Hermes running locally. Dependencies, GPU drivers, API rate limits—it was a nightmare. Now I have a fully managed hermes agent webui that costs less than my monthly coffee budget. The platform also includes Paperclip (the planning layer) and OpenClaw (the execution layer), so I have a complete AI army.

If you want a hermes agent ui that just works, without the DevOps headache, give OneManArmy a try. Start with a free tier and see how Hermes transforms your workflow.

For more information and documentation, visit the official project website at OneManArmy.

Hermes Agent & OpenClaw: Deploy AI Workers in 5 Minutes

fred — Sat, 13 Jun 2026 15:52:14 +0000

Hermes Agent & OpenClaw: Run an AI Army from One Dashboard

What is OneManArmy?

OneManArmy is a cloud-hosted command dashboard that deploys three best-in-class AI workers: Paperclip, OpenClaw, and Hermes. You get a unified interface to manage planning, execution, and memory — all without touching a server.

Why Hermes Agent?

Hermes is a self-learning AI intelligence specialist. It writes its own skills, remembers business context across clients and campaigns, and currently ranks #1 on OpenRouter's global token rankings. Think of it as your persistent memory layer that gets smarter over time.

Why OpenClaw?

OpenClaw is the execution layer. It takes tasks from Paperclip (the planner) and runs them in the real world — sending messages, scraping data, updating databases. You can talk to OpenClaw via the web dashboard, Telegram, or Discord.

The Stack

Paperclip: AI commander that breaks down goals into roles and runs the org chart of an entire company autonomously, with project-management-style UI.
OpenClaw: AI field operator that executes skills and workflows.
Hermes: Self-learning memory specialist.
Integration: OpenRouter API, Telegram, Discord.

No Setup Required

OneManArmy is fully hosted. No Docker, no API key hunting, no server management. You can go from signup to running your first AI workflow in under 5 minutes.

Code Example: Talking to OpenClaw via Telegram

import requests

# Your OneManArmy API token (from dashboard)
API_TOKEN = "your_token_here"
BASE_URL = "https://onemanarmy.pages.dev/api"

# Send a command to OpenClaw via Telegram
def send_command(command):
    response = requests.post(
        f"{BASE_URL}/openclaw/execute",
        headers={"Authorization": f"Bearer {API_TOKEN}"},
        json={"command": command, "platform": "telegram"}
    )
    return response.json()

# Example: scrape a website
result = send_command("Scrape the latest news headlines from Hacker News")
print(result)

Use Cases

Solo entrepreneur: Automate customer support, lead generation, and content creation.
Small business: Deploy a full marketing team (strategist, writer, editor) from one dashboard.
Developer: Prototype AI workflows without infrastructure overhead.

Get Started

Head over to OneManArmy and create your account. Want to earn while sharing? Join the affiliate program.

Hermes agent and OpenClaw: two powerful AI workers, one simple dashboard.

Guard Skills: The AI Code Quality Alternative That Catches Failure Modes Before They Ship

fred — Fri, 12 Jun 2026 00:14:31 +0000

Guard Skills: The AI Code Quality Alternative That Catches Failure Modes Before They Ship

If you're looking for a serious AI code quality alternative to traditional tools, Guard Skills is the missing piece in your AI-assisted development pipeline. Hallucinated APIs, mock abuse, premature abstraction, and documentation that references functions that don't exist are becoming everyday problems in AI-assisted development. This open-source collection of quality gates sits between your agent's output and your production repository.

1. The Problem: AI-Generated Code Has Systematic Failure Modes

Let's be honest about where we are. Tools like Claude Code, Codex, Cursor, and OpenCode can generate 100 lines of working code in seconds. But working code isn't the same as production-quality code.

Research cited in the Guard Skills project references published findings on duplication growth in LLM output, package hallucination rates, and the tendency of agents to declare success despite failing tests. These aren't edge cases — they're systematic failure modes baked into how large language models generate code.

What does this look like in practice?

Premature abstraction — an agent wraps everything in interfaces and factories because that pattern scored well in training
Broad error swallowing — every function becomes try { ... } catch { return ok } because the model learned to prioritize "completing" over "handling"
Hallucinated dependencies — the agent imports libraries that don't exist or uses APIs that were mixed up from different versions
Mock abuse — test suites that mock their own data objects, test logging messages, and assert on implementation details that change with every refactor
Documentation drift — READMEs and docstrings that claim features, reference nonexistent functions, and include sample code that would crash on first execution

These problems evade linters, fly past SonarQube, and survive manual review because they look correct — they're structurally valid code that happens to be structurally wrong for your actual use case.

2. What Are Guard Skills?

Guard Skills is an open-source collection of second-pass quality gates designed specifically for AI-generated code. Think of them as specialized code reviewers that understand both general software engineering principles and the specific failure patterns that LLMs produce.

Each guard is a single skill file you install via the Skills CLI. When you invoke a guard on a diff or a codebase, it scans for violations across five dimensions:

Guard	Best Use	Catches
clean-code-guard	Production code, any language	LLM code smells, over-abstraction, bad names, SOLID violations
test-guard	Test suites	Mock abuse, dead tests, implementation-detail assertions
docs-guard	READMEs, API docs, changelogs	Hallucinated symbols, broken samples, docs-vs-code drift
wp-guard	WordPress plugins, themes, blocks	Missing sanitization, nonce/capability gaps, unprepared queries
woo-guard	WooCommerce extensions	HPOS breakage, checkout bypasses, money-handling errors

The workflow is simple: let your agent do the work, then invoke the relevant guard before you present, commit, or merge. You can also run guards up front to constrain agent behavior during generation.

3. Why Traditional Quality Tools Aren't Enough

Before we dive into each guard, let's address the elephant in the room: why can't you just use what you already have?

Manual Code Review

Human review is falling behind AI output velocity. A single developer with Claude Code can produce 10x the code they used to, but review bandwidth hasn't scaled. More critically, human reviewers tend to rubber-stamp AI-generated code because it looks correct at a glance — the same failure mode the LLM has. Guard Skills never gets tired, never rubber-stamps, and catches the subtle patterns humans miss.

Linters (ESLint, Pylint, PHPCS)

Linters check syntax, formatting, and a limited set of best practices. They don't understand that a test that mocks every object in sight is a maintenance nightmare. They don't flag a docs section that references get_user_by_email() when your API actually uses User::findByEmail(). Guard Skills operates at the semantic level — it understands code, tests, and documentation as interconnected systems.

SonarQube

SonarQube is excellent for detecting code duplications, security hotspots, and complexity metrics. But it was built in a pre-AI world. It doesn't know about LLM-specific failure modes like package hallucination, docstring-API drift, or the tendency of agents to over-abstract. Guard Skills fills that gap specifically. Think of it as a SonarQube for the AI era — or more accurately, as a complement that catches what SonarQube misses.

Together, these tools work great. But if you're relying on any single one to catch AI-generated failure modes, you're leaving money on the table. Guard Skills is the missing piece — the AI code quality alternative that targets the specific failure patterns modern coding agents produce.

4. clean-code-guard: Stop LLM Code Smells at the Gate

The clean-code-guard is the workhorse of the collection. It applies Clean Code, SOLID, DRY/KISS/YAGNI principles to generated code in any language, plus an AI-specific layer that catches patterns unique to LLM output.

What it catches:

Catch-all error swallowing — every function wrapped in try/catch returning a generic success
Hardcoded success returns — "TODO: implement later" hidden behind a return true
Hallucinated APIs — calling methods or importing modules that don't exist in your dependencies
Premature abstraction — interfaces, factories, and dependency injection where a simple function would do
Comment pollution — AI-generated comments that explain the obvious while missing the important
Copy-from-similar bugs — the agent copied implementation pattern A for use case B, and the subtle mismatch is invisible at a glance

The guard references published research on LLM duplication growth and agents declaring success despite failed tests. When you run it, you get rule-by-rule feedback with specific line numbers and fix suggestions.

CTA: Ready to stop AI code smells before they hit your repo? Get Guard Skills on GitHub — install in under a minute.

5. test-guard: Kill Mock Abuse and Dead Tests

AI agents love writing tests — but they write the wrong kind. The test-guard enforces nine universal testing rules that cut through the noise:

Mock only at system boundaries — never mock your own objects, only external dependencies
Never mock your own state objects — if the test mocks a data class from your domain, it's testing implementation, not behavior
Parametrize instead of copy-pasting — duplicate test bodies with different inputs should be one parametrized test
Delete tests that catch nothing — if a test can't fail, it's dead weight
Treat production regression tests as sacred — never modify or delete regression tests without explicit justification
Avoid implementation-detail assertions (don't assert on log messages, internal calls, or private state)
Prefer real integration over deep mocking for your own code
Test outcomes, not internals
Write test descriptions that say what is tested, not that it's tested

Framework-specific progressive-disclosure references cover pytest, PHPUnit/Pest, Jest/Vitest, Go tests, and WordPress/WooCommerce test patterns.

6. docs-guard: No More Hallucinated Symbols

Documentation is where AI-generated code hurts most. A README that references a get_user_premium_status() function that doesn't exist doesn't just mislead — it erodes trust in your entire codebase.

The docs-guard treats documentation as a list of claims and verifies every one against the actual code:

Every function/class/method referenced in docs is checked for existence
Code samples are flagged if they use APIs that don't match the codebase
@param and @return tags must match real signatures
Changelog entries are verified against the commit history
Unverifiable claims ("blazingly fast", "enterprise-grade") get flagged for removal

This covers READMEs, API references, PHPDoc/JSDoc annotations, changelogs, and tutorials.

7. WordPress-Specific Guards: wp-guard and woo-guard

If you work in the WordPress ecosystem, two specialized guards handle the platform-specific failure modes that generic quality gates miss.

wp-guard catches: missing escaping and sanitization, absent nonce and capability checks, raw SQL queries instead of $wpdb->prepare(), failure to use Core APIs before custom plumbing, strings that aren't translation-ready, and query/caching mistakes like posts_per_page => -1 on large sites.

woo-guard (built on top of wp-guard) catches: direct order meta access instead of CRUD methods, HPOS compatibility breakage, missing feature-compatibility declarations, checkout bypasses that rely on client-side validation, money-handling errors, and template overrides instead of hooks.

Together, these two guards make AI-assisted WordPress development production-safe.

8. Guard Skills vs. the Alternatives: A Realistic Comparison

Let's put Guard Skills in context alongside the three most common quality approaches:

Criterion	Manual Code Review	Linters (ESLint, etc.)	SonarQube	Guard Skills
Catches syntax errors	Yes	Yes	Yes	No (not its job)
Enforces formatting	No	Yes	Yes	No
Detects LLM-specific patterns	Rarely	No	No	Yes
Catches hallucinated APIs	Sometimes	No	No	Yes
Tests test quality	No	No	Limited	Yes
Checks docs against code	No	No	No	Yes
WordPress/WooCommerce aware	If reviewer knows it	No	Partial	Yes
Scales with AI output velocity	No	Yes	Yes	Yes
Installation time	N/A	Minutes	Hours	< 60 seconds

The key insight: Guard Skills doesn't replace any of these tools — it complements them. Run linters for syntax, SonarQube for complexity, and Guard Skills for the AI-specific failure modes that your existing pipeline ignores.

9. How to Get Started in 60 Seconds

Guard Skills is MIT-licensed and installs in seconds.

# Install all guards
skills add amElnagdy/guard-skills

# Or install just what you need
skills add amElnagdy/guard-skills/clean-code-guard
skills add amElnagdy/guard-skills/test-guard
skills add amElnagdy/guard-skills/docs-guard

Works with Claude Code, Codex, Cursor, and OpenCode. After installation, invoke a guard on any diff:

Use $clean-code-guard on the diff you just produced.
Use $test-guard on the tests you just wrote.
Use $docs-guard on this README update before we ship it.

The guard scans your code and returns specific, actionable feedback — not generic advice.

CTA: Stop shipping AI failure modes. Install Guard Skills now — it's free, open source, and takes one command.

10. Conclusion: The Missing Piece in AI-Assisted Development

AI coding agents aren't going anywhere. Every month they get faster, more capable, and more deeply integrated into our workflows. But with that power comes a new class of quality problems — problems that traditional tools weren't designed to catch and human review can't keep up with.

Guard Skills fills that gap. It's the AI code quality alternative that sits between your agent's output and your production repository, catching hallucinated APIs, mock abuse, documentation drift, and WordPress security gaps before they ship.

The five guards — clean-code-guard, test-guard, docs-guard, wp-guard, and woo-guard — cover the full spectrum of AI-generated failure modes across general code, tests, documentation, and the WordPress ecosystem. They're fast, specific, and designed for the workflow you already have.

Install it today:

skills add amElnagdy/guard-skills

CTA: Ship better code tomorrow. Get Guard Skills on GitHub — MIT licensed, 60-second setup, works with every major AI coding agent.

Frequently Asked Questions

Q: Do Guard Skills replace my existing linter or CI pipeline?

No. Guard Skills targets AI-specific failure modes that linters and static analysis tools miss. They complement tools like ESLint, PHPCS, and SonarQube by catching semantic issues — hallucinated APIs, documentation drift, mock abuse — that operate above the syntax layer.

Q: Which AI coding agents are supported?

Guard Skills works with any agent supported by the Skills CLI, including Claude Code, Codex (by OpenAI), Cursor, and OpenCode. The guards are agent-agnostic — they analyze code and text, not agent internals.

Q: Can I use Guard Skills for non-AI-generated code?

Absolutely. While the guards are optimized for AI failure modes, the clean-code-guard applies universal Clean Code and SOLID principles that are valuable regardless of who wrote the code. The WordPress guards enforce security and best-practice rules that every WordPress developer should check against.

Q: How long does it take to set up?

You can install all five guards with a single command (skills add amElnagdy/guard-skills) and start using them immediately. No configuration files, no CI pipeline changes, no lengthy setup. Most users go from zero to running their first guard in under 60 seconds.

Q: Is Guard Skills really free and open source?

Yes. Guard Skills is MIT-licensed and available on GitHub. There are no paid tiers, no usage limits, and no SaaS dependency. What you see on GitHub is what you get.

Guard Skills: catch AI failure modes before they ship.

MCP Server Generator: Turn Any App into an AI-Ready MCP Tool in 60 Seconds

fred — Fri, 12 Jun 2026 00:12:33 +0000

Are you still hand-writing MCP servers for every API, frontend, and database in your stack? If you're building AI agents, you've probably felt the pain: days of boilerplate, constant drift when your app changes, and brittle tools that break silently.

There's a better way. Meet MCPify — an AI enablement compiler that turns your existing codebase into a fully operational MCP server in under a minute.

The Problem With Manual MCP Servers

Building an MCP server by hand sounds straightforward. In practice, it's a maintenance nightmare:

Setup takes 2-5 days — you need to learn the MCP spec, define every tool's schema
Constant drift — add one API endpoint and your MCP server falls out of sync
Limited coverage — most hand-written servers only cover APIs
Reinventing the wheel — every project starts from scratch

Enter MCPify: The MCP Server Generator

MCPify (by amarnath3003) is a zero-config CLI that scans your entire codebase and automatically generates a complete MCP server with semantic workflows, permission-aware tools, and safety audits.

Ready to try it? See how MCPify works →

Key Features That Make It Different

Auto-Discovery

MCPify detects everything agents might need:

Backends: Express, Fastify, Next.js API routes
Frontends: React, Angular, Vue components
Databases: Prisma, Mongoose, TypeORM schemas
Events: RabbitMQ, Kafka, SQS

One-Command Generation

npx mcpify-cli

No install, no config. It scans your current directory and produces a complete MCP server.

Built-In Safety

npx mcpify-cli audit ./my-app
npx mcpify-cli simulate ./my-app

MCPify vs Manual MCP Server

Factor	Manual	MCPify
Setup time	2-5 days	~30 seconds
Learning curve	Must learn MCP spec	Zero
Maintenance	Constant drift	Auto-syncs
Coverage	APIs only	Full stack
Safety	Manual review	Audit + simulation
First server	Days	Minutes

Step-by-Step Tutorial

git clone https://github.com/amarnath3003/MCPify.git
cd MCPify
npx mcpify-cli . --demo ecommerce

Point any MCP-compatible agent to the generated server.

Try it yourself: Generate your first MCP server

Frequently Asked Questions

Q: Is MCPify free?
A: Yes, it's open source. No hidden pricing.

Q: Does MCPify work with non-Node.js projects?
A: Use the Swagger/OpenAPI path for non-Node stacks.

Q: MCPify vs building manually?
A: For most projects, MCPify wins on speed and coverage. Manual makes sense for platform-scale MCP servers.

Q: Is it production-ready?
A: Early-stage (42 stars, 61 commits) but functional with audit/simulation tools.

The Bottom Line

If you're building AI agents that need to interact with real applications, MCPify saves you days of boilerplate and keeps your MCP server in sync as your codebase evolves.

Start building with MCPify today:
https://link-tracker-hej.pages.dev/click/mcpify

Ory Talos: Open-Source API Key Management for High-Throughput Systems

fred — Fri, 12 Jun 2026 00:11:20 +0000

Ory Talos: Open-Source API Key Management for High-Throughput Systems

Your API keys are probably a mess. If your system issues hundreds of thousands of API keys across services, CI/CD pipelines, and AI agents, you've felt the pain: static keys that live forever, granting blanket access with zero visibility. A leaked key means scrambling through logs. A compromised agent means rotating every credential in the system.

Most teams paper over this with a database table and a random string generator. It works — until it doesn't. When your key verification needs to happen on the hot path at thousands of requests per second, and every millisecond of latency matters, a makeshift solution becomes a liability. That's where Ory Talos comes in.

Ory Talos is an open-source API credential management server built specifically for high-throughput systems. Think of it as a purpose-built vault for non-human identities — service accounts, CI/CD tokens, and AI agent credentials — with an architecture that prioritizes low-latency verification and horizontal scalability from day one.

The Credential Crisis Nobody Talks About

API keys are the duct tape of modern authentication. They're everywhere: in config files, CI/CD secrets, service mesh configurations, and increasingly attached to AI agents making autonomous decisions. Yet most infrastructure treats them as second-class citizens.

Here's the reality of rolling your own API key system:

No granularity. A single compromised key exposes the full scope of permissions. You can't issue a key that's read-only on one endpoint and write-only on another without building that logic yourself.
No revocation at scale. Rotating keys means updating every consumer — painful when you have hundreds of services.
No audit trail. Who issued what key, when, and to whom? Good luck tracing that through raw database queries.
No performance guarantees. Your verification endpoint shares resources with everything else. When traffic spikes, key checks slow down across the board.

These aren't edge cases. They're the daily reality for teams running microservice architectures, multi-tenant SaaS platforms, or anything involving automated agents hitting APIs.

What Is Ory Talos?

Ory Talos is a standalone server for issuing, verifying, managing, and revoking API keys at scale. It's built by Ory Corp — the identity infrastructure company behind Ory Kratos (user management), Ory Hydra (OAuth2/OIDC), and Ory Oathkeeper (identity proxy). Talos fills a gap those tools intentionally leave open: non-human identity and API credential management.

What makes Talos different from tossing a crypto library at the problem? Three things:

It's a server, not a library. Centralized credential management means consistent policy enforcement, real-time revocation, and audit logging without wiring SDKs into every service.
It's built for throughput. The entire architecture is optimized for sub-millisecond key verification on the hot path.
It supports token derivation. This is the killer feature — you can derive limited-scope tokens from a master API key, giving callers only what they need without creating permanent credentials.

Key Features That Matter

Here's what Ory Talos brings to the table in practical terms:

Token Derivation. Generate scoped, short-lived tokens from a root API key. An AI agent that needs to read from one endpoint gets a derived token that only works on that endpoint, for a limited time. If it's compromised, the blast radius is one agent, one operation — not your entire system.

Low-Latency Verification. Talos is designed for the hot path. Constant-time comparisons, in-memory caching, and optimized lookup paths mean your API key checks don't become a bottleneck under load.

Horizontal Scalability. Add more instances, get more throughput. Talos is stateless on the verification path — you can scale out horizontally without coordination overhead.

Security Hardening. Constant-time comparisons prevent timing attacks. Centralized credential routing means keys never leak into application logs. Per-tenant network isolation keeps multi-tenant environments properly segmented.

Open Source (Apache 2.0). The core is fully open source. You can run it yourself, inspect every line of code, and build exactly what you need without vendor lock-in. For high-availability production deployments, Ory offers an Enterprise License with SLAs and advanced features.

How Talos Compares to the Alternatives

If you're managing API keys today, you're probably using one of these approaches. Here's how they stack up against Ory Talos:

Aspect	Ory Talos	AWS API Gateway	Kong	Custom (DIY DB)
Purpose	Dedicated API key server	API gateway with key features	API gateway with key auth	Whatever you built
Key verification latency	Sub-millisecond (hot-path optimized)	Low (but tied to AWS region)	Low (NGINX-based)	Depends on your DB and code
Token derivation	Built-in (capability tokens)	Not available	Via custom plugins	Would need custom implementation
Revocation model	Real-time, centralized	Key-level, can be slow at scale	Key-level via plugins	Manual (delete from DB)
Self-hosted	Yes (Apache 2.0)	No (managed only)	Yes (open source tier)	N/A (it's your own code)
Horizontal scaling	Designed for it from scratch	Auto-scaling (managed)	Yes, with DB dependency	Whatever your infra supports
Pricing	Free (OSS) + Enterprise option	Pay per request / API call	Free (OSS) + Enterprise	Your engineering hours
AI agent / NHI support	First-class (key derivation, agent scoping)	Not specialized	Via plugins	Would need custom work

The short version: AWS API Gateway is great if you're all-in on AWS and need a managed gateway. Kong is a solid general-purpose API gateway. But if your use case is specifically managing API credentials at scale — especially for non-human identities like AI agents and CI/CD pipelines — Ory Talos is purpose-built for that job in a way the alternatives aren't.

Getting Started: Run Ory Talos in 5 Minutes

Let me walk you through setting up Ory Talos locally. You'll have a working API key server running in your terminal by the time you finish this section.

Prerequisites

Docker and Docker Compose installed
A terminal you're comfortable with

Step 1: Clone the Repository

git clone https://github.com/ory/talos.git
cd talos

Step 2: Start Talos with Docker Compose

docker compose -f docker-compose.oss.yaml up

That's it. The API becomes available at http://localhost:4420 within seconds.

Step 3: Create Your First API Key

With Talos running, create an API key using a simple curl command:

curl -X POST http://localhost:4420/keys \
  -H "Content-Type: application/json" \
  -d '{"name": "my-first-key", "permissions": ["read:docs"]}'

You'll get back an API key. Save it — it won't be shown again.

Step 4: Verify the Key

curl http://localhost:4420/verify \
  -H "Authorization: Bearer <your-api-key>"

Talos returns the key's metadata, permissions, and validity status — all in a few milliseconds.

Step 5: Derive a Scoped Token

This is where Talos shines. From your master key, derive a scoped sub-token:

curl -X POST http://localhost:4420/keys/<key-id>/derive \
  -H "Content-Type: application/json" \
  -d '{"permissions": ["read:docs"], "ttl": "15m"}'

This gives you a short-lived token that can only read the docs endpoint. Hand it to an AI agent, a CI job, or a temporary integration, and never worry about a leaked master key again.

Step 6: Revoke When Done

When the job finishes or the agent is decommissioned:

curl -X DELETE http://localhost:4420/keys/<key-id>

That key stops working immediately — no propagation delay, no stale caches.

Want to try it on Ory Network instead? The managed version handles scaling, backup, and failover for you. Check out Ory Talos pricing and plans here.

Who's Using Ory Talos (and Why It Matters)

Ory Talos is part of the Ory ecosystem, which collectively handles 7 billion+ API requests every day across thousands of companies. The Ory community counts over 50,000 members, and the projects are battle-tested in production environments ranging from startups to Fortune 500 enterprises.

Companies adopt Ory Talos for three patterns I see over and over:

AI agent credential management. Agents need API access, but you don't want permanent keys in agent configs. Derive short-lived tokens, scope them to exactly what the agent needs, and revoke them when the agent is done.
Multi-tenant SaaS API key portals. Let your customers generate and manage their own API keys through a standardized interface, with proper permission scoping and audit trails.
CI/CD pipeline rotation. Automatically derive fresh tokens for each build, scope them to the deployment environment, and expire them when the pipeline finishes.

The combination of token derivation, real-time revocation, and horizontal scalability is what makes Talos viable for these workloads. Other tools handle one or two of these well; Talos handles all three without compromise.

Why You Should Care About API Key Management Right Now

Non-human identities now outnumber human identities in most organizations. AI agents, CI/CD pipelines, service accounts, and machine-to-machine traffic represent the fastest-growing attack surface in enterprise infrastructure. Static, permanent API keys — the default for most teams — are the weakest link.

Ory Talos gives you a way out: dynamic, revocable, least-privilege credentials designed for the throughput demands of modern systems. Whether you self-host the Apache 2.0 version or go with the managed offering, you stop treating API keys as afterthoughts and start treating them as proper security primitives.

Here's what I'd recommend:

Try it locally. The Docker Compose setup takes minutes. Create a few keys, derive some tokens, see how the revocation feels.
Look at your current key sprawl. How many permanent API keys are floating around your systems? How many could be replaced with scoped, short-lived tokens?
Evaluate Talos for production. If you're managing hundreds or thousands of API keys, the operational savings alone are worth the migration.

Ready to dive deeper? Explore Ory Talos documentation and deployment options here.

Get started on Ory Network. The fastest path to production is the managed service. See plans and sign up for free.

Frequently Asked Questions

What problems does Ory Talos solve that a simple database table can't?

A database table with randomly generated strings handles basic key storage, but it falls apart under real-world demands. Ory Talos provides constant-time verification (preventing timing attacks), built-in token derivation for granular scoping, real-time revocation that takes effect immediately (no cache TTL waits), and horizontal scalability designed for hot-path verification. These aren't features you can bolt on to a simple database solution without significant engineering investment.

How does Ory Talos compare to Kong for API key authentication?

Kong is an API gateway that includes API key authentication as one of many features. Ory Talos is a dedicated API key server focused specifically on credential lifecycle management. Kong can validate keys at the gateway layer, but it doesn't offer token derivation, fine-grained capability tokens, or the same level of non-human identity specialization. If you need an API gateway with basic key auth, Kong works. If you need a dedicated credential management system for high-throughput agent and service authentication, Talos is the better fit.

Can Ory Talos handle API key management for AI agents and LLM integrations?

Yes — this is one of its primary use cases. Token derivation allows you to issue short-lived, scoped credentials for AI agents. Instead of embedding a permanent master API key in an agent's configuration, you derive a token limited to exactly the endpoints and operations the agent needs, set a short TTL, and revoke it when the agent task completes. This minimizes blast radius if the agent is compromised.

Is Ory Talos production-ready? What about high availability?

The Apache 2.0 open-source version is suitable for development, prototyping, and low-traffic production workloads. For high-availability production deployments with guaranteed SLAs, CVE fixes, and enterprise support, Ory offers the Ory Enterprise License (OEL). You can also run Talos on the managed Ory Network, which handles scaling, failover, and maintenance.

Do I need to replace my existing API gateway to use Ory Talos?

Not at all. Ory Talos works alongside your existing gateway infrastructure. Talos handles the credential management layer — issuing, verifying, and revoking keys — while your gateway continues to handle routing, rate limiting, and request transformation. Many teams run Talos behind Kong or AWS API Gateway, using the gateway for routing and Talos for authentication decisions.

Wrapping Up

API key management is one of those problems that stays under the radar until it blows up. A leaked credential, a slow verification endpoint under load, a multi-tenant key scope nightmare — these are the things that ruin weekends.

Ory Talos gives you a dedicated, open-source solution that handles the credential lifecycle properly. Token derivation alone is worth the look if you've ever wished you could issue a key that only does one thing. Add in the performance characteristics and the Ory ecosystem's track record, and it's a compelling piece of infrastructure for anyone managing API access at scale.

The Docker Compose setup takes five minutes. Go give it a spin — I think you'll be surprised at how much of the complexity just disappears.

OneManArmy Review: Deploy 3 AI Bots from One Dashboard

fred — Thu, 11 Jun 2026 23:17:26 +0000

You know that feeling when you have got five browser tabs open --- ChatGPT on one, Claude on another, a Docker container spitting errors on a third --- and you are still no closer to actually shipping anything? Yeah, me too. AI tools are supposed to make us faster, but lately it feels like we are spending more time wrangling APIs and managing subscriptions than actually getting work done.

That is exactly why OneManArmy caught my attention. It is pitched as the first hosted command dashboard that lets solo operators deploy three powerful AI bots from a single cloud platform --- no Docker, no terminal, no API key hunting. Sounded too good to be true, so I dug in.

The Real Problem With AI Tools Right Now

Here is the awkward truth nobody is talking about: the AI tooling landscape for solo devs and indie makers is a mess.

Option 1: DIY everything. Spin up Docker containers, configure environments, manage API keys across multiple providers, hunt down rate limits, and pray nothing breaks when you update a dependency. This works, but it eats hours you could spend building actual product.

Option 2: Subscribe to everything. ChatGPT Plus ($20/mo), Claude Pro ($20/mo), maybe a specialized coding tool on top ($10-$30/mo), plus API credits for whatever you are building. You are easily looking at $50-$100/month before you have done anything useful.

Option 3: Single-bot tools. They do one thing well, but you need three or four of them to cover planning, execution, and research. Good luck getting them to talk to each other.

None of these scale for someone working alone. You need planning, execution, and intelligence gathering --- but you do not need the operational overhead of three separate platforms.

What Is OneManArmy?

OneManArmy is a hosted cloud dashboard that bundles three distinct AI bots under one roof. You sign up, pick your bot, and it is live in under five minutes. Real "from zero to running" stuff.

The three bots are:

Paperclip --- Your AI Commander/CEO. You give it a high-level goal, and it breaks that goal down into roles, assigns tasks, and creates a structured plan. Think of it as your strategic layer.
OpenClaw --- Your AI Field Operator/Doer. This is the tactical executor. It runs skills, executes commands, and can operate through Web, Telegram, or Discord. Give it a plan from Paperclip, and OpenClaw executes.
Hermes --- Your AI Intelligence Specialist. This one is self-learning --- it writes its own skills and improves over time. It is also #1 on OpenRouter global token rankings at 353 billion tokens processed. That is not a typo.

It is a one-time payment of $47 for a Commercial license. No monthly fees. That alone felt like a breath of fresh air.

Ready to see it in action? Grab the OneManArmy Commercial license here ->

Key Features Worth Talking About

AI Agent Library --- 39+ pre-built specialists you can deploy immediately. Need a customer support agent? A research assistant? A code reviewer? They are in the library, ready to go.

Multi-channel deployment --- Your bots can operate through Web UI, Telegram, or Discord. No configuration gymnastics to switch between them.

Self-improving bots --- Hermes, specifically, writes its own skills on the fly. It learns from what works and adapts. That is a genuinely different approach from static prompt templates that break the moment your use case shifts slightly.

Operator Academy --- Included training to help you actually get the most out of the platform. Not just documentation --- structured learning.

Hosted, zero-infrastructure --- The entire thing runs in the cloud. No Docker compose files, no server provisioning, no "works on my machine" nonsense.

OneManArmy vs. The Alternatives

Feature	OneManArmy ($47 one-time)	DIY Docker Setup (free, but...)	ChatGPT + Claude ($99-169/mo)	Single-Bot Tools
Setup time	Under 5 minutes	Hours to days	Minutes (but separate accounts)	Minutes each
Multi-bot coordination	Built-in (3 bots)	You build it	Manual copy-paste	None
Infrastructure	Hosted	Self-managed	Hosted (separately)	Hosted (separately)
Self-learning	Yes (Hermes)	No	No	Rare
Cost model	One-time $47	Free + your time + hosting	$99-169/month recurring	$10-50/month each
Pre-built agents	39+	You write them	GPTs store (limited)	Varies
Learning curve	Minimal	Steep	Low	Low

The one-time payment is the standout here. For $47, you are paying less than two months of a single ChatGPT subscription --- and getting three coordinated bots that actually work together.

How to Get Started (Step-by-Step)

I walked through the setup myself, and it is refreshingly simple:

Go to the OneManArmy site and grab the Commercial license for $47.
Create your account with standard email/password setup.
Choose your first bot --- I started with Paperclip to plan out a content workflow.
Configure your channel --- picked Telegram because I live there. About 90 seconds.
Give it a task --- I asked Paperclip to build a content strategy for a solo SaaS founder.
Hand off to OpenClaw --- sent the plan over and OpenClaw started executing.
Let Hermes optimize --- after a few runs, Hermes reviewed and wrote a custom skill on the spot.

Total time from sign-up to first useful output: under 5 minutes. I timed it.

What Early Users Are Saying

The early community feedback has been solid. Users consistently mention three things:

"It actually works out of the box." No tweaking, no debugging prompts on day one.
"The three-bot coordination is real." Paperclip plans, OpenClaw does, Hermes improves.
"The $47 price point feels almost low for what it does." Comparable setups cost $100+/month elsewhere.

Some users wish the agent library had even more specialists (there are 39+ now), but the consensus is the foundation is strong and the self-learning aspect means the platform gets better over time.

Your Move

If you are tired of managing three separate AI subscriptions and still not getting the coordination you need, OneManArmy is worth a serious look. One payment, three bots, no infrastructure headaches.

Check out OneManArmy here ->

Frequently Asked Questions

Can OneManArmy replace ChatGPT and Claude for day-to-day tasks?
For most solo operators, yes. Between Paperclip strategic planning, OpenClaw execution, and Hermes self-learning research capabilities, you cover the same ground as a ChatGPT+Claude subscription combo without the monthly bill.

Do I need to know how to code to use OneManArmy?
Not at all. The whole point is that it is a hosted dashboard. You configure bots through the UI, deploy via web/Telegram/Discord, and never touch a terminal.

Is the $47 really a one-time payment with no hidden fees?
Yes. One-time payment for the Commercial license. No monthly subscription, no surprise upsells, no pay per API call gotchas.

How does Hermes compare to OpenAI o1 or Claude Sonnet for research?
Hermes has processed 353 billion tokens on OpenRouter --- more than any other model. It is designed for intelligence gathering and self-improvement, and it gets better at your specific tasks over time.

What happens if I need support?
The Operator Academy covers the learning curve, and there is an active community around the platform.

Final Thoughts

OneManArmy solves a real problem for solo operators: you need multiple AI capabilities, but you do not want the operational and financial overhead of multiple tools. The three-bot architecture --- Paperclip (plan), OpenClaw (do), Hermes (learn) --- is genuinely well thought out, and the one-time $47 price makes it a no-brainer compared to recurring subscriptions.

Is it perfect? Nothing is. But for the price of a decent dinner, you get three coordinated AI bots, 39+ pre-built specialists, multi-channel deployment, and a platform that improves over time. That is a pretty good deal.

Get started with OneManArmy ->

This article contains affiliate links. I may earn a commission if you purchase through them, at no extra cost to you.

How to Turn Any App into an MCP Server with MCPify

fred — Thu, 11 Jun 2026 18:38:58 +0000

The AI landscape is shifting fast. Every week, a new agent framework, a new protocol, a new way for AI to interact with the world. But one thing has become painfully clear: most of our existing software was never built for AI agents to use.

You have a SaaS product, a REST API, a database, maybe a frontend with useful actions. An AI agent cannot touch any of it without brittle browser automation or hand-written boilerplate. That is where MCPify comes in.

MCPify is an open-source AI enablement compiler that transforms existing applications into AI-native, agent-operable systems. Instead of manually writing MCP server code for every tool you want an agent to use, you point MCPify at your codebase and it does the heavy lifting automatically.

In this tutorial, I will walk you through turning any app into an MCP server using MCPify --- no prior MCP experience required.

What Is MCP (Model Context Protocol)?

Before we dive in, a quick refresher. The Model Context Protocol (MCP) is an open standard that defines how AI applications connect to external tools and data sources. Think of it as USB-C for AI agents --- a universal interface that lets any MCP-compatible client (Claude Desktop, Cursor, VS Code extensions, custom agents) talk to your services.

An MCP server exposes tools that an AI agent can discover, inspect, and invoke at runtime. Building these servers manually for each endpoint, database query, or business workflow is tedious and does not scale.

Enter MCPify: The MCP Server Generator

MCPify (https://github.com/amarnath3003/MCPify) is an AI enablement compiler that scans your application and automatically generates a complete MCP server. It works by performing static analysis on your codebase --- frontend components, backend routes, API definitions, event handlers, and workflow logic --- and compiling that into MCP-compatible tools.

Why MCPify stands out:

Zero manual tool writing --- it discovers tools from your code automatically
Permission-aware --- generated tools include safety boundaries so agents operate within safe limits
Stay in sync --- regenerate whenever your codebase changes; the MCP server is always up to date
CI/CD integration --- MCPify runs in your GitHub Actions pipeline, so every PR recompiles fresh tools
Swagger/OpenAPI support --- have an API spec? MCPify converts it to MCP tools in one command

If you have been searching for an MCP server generator that actually works, this is it.

Quick Start: No Install Required

MCPify ships as a CLI tool via npm. You do not even need to install it --- just run it directly with npx:

npx mcpify-cli

This launches an interactive mode that guides you through analyzing your project. If you want to see it in action immediately, try it against the built-in ecommerce example:

npx mcpify-cli examples/ecommerce-saas

Within seconds, MCPify scans the example app and generates a complete MCP server in the output directory. Open the generated AGENTS.md for instructions on connecting it to any MCP client.

Tutorial: MCPify Your Own App

Let us go step by step with a real-world scenario.

Step 1: Run the Analyzer

Navigate to your project root and run:

npx mcpify-cli analyze .

The analyze command runs the full pipeline: scanning, compiling, and generating the MCP server along with metadata your agent needs.

Step 2: Choose Your Analyzers

MCPify uses pluggable analyzers to understand different parts of your stack:

Frontend analyzer --- extracts UI actions (button clicks, form submissions, navigation)
Backend analyzer --- discovers REST routes, middleware, and business logic
Database analyzer --- identifies schemas, queries, and stored procedures
Event analyzer --- captures event handlers and webhook listeners
Workflow analyzer --- maps multi-step processes your app supports

Use the interactive command to select which analyzers to run:

npx mcpify-cli interactive

Step 3: Review the Generated MCP Server

After analysis, MCPify writes the generated server to your output directory (default: mcpify-output/). The server is a standalone Node.js application implementing the MCP specification. You will find:

server.js --- the MCP server entry point
tools.json --- a manifest of all discovered tools with their schemas
AGENTS.md --- setup instructions for connecting to MCP clients
workflows/ --- semantic workflow definitions discovered in your app

Step 4: Connect to an MCP Client

Follow the instructions in AGENTS.md. Typically this means adding the server to your client configuration. For Claude Desktop, you would add an entry to your claude_desktop_config.json:

{
  "mcpServers": {
    "my-app": {
      "command": "node",
      "args": ["path/to/mcpify-output/server.js"]
    }
  }
}

Restart your client, and your AI agent can now interact with your application through natural language.

Advanced: Swagger/OpenAPI to MCP

Already have an API specification? MCPify can convert it directly:

npx mcpify-cli swagger ./openapi.yaml

This is incredibly useful if you maintain a public API --- every endpoint becomes an MCP tool automatically, complete with request/response schemas.

CI/CD Integration

For teams that want this to be automatic, MCPify includes a GitHub Actions workflow. Every time you push to main or open a PR, MCPify recompiles your MCP server. This means your AI tools are never out of sync with your codebase.

Check the .github/workflows folder in the MCPify repo for a ready-to-use workflow template.

Why Developers Love MCPify

Since launching on GitHub, MCPify has been gaining traction (41 stars and rising) because it solves a real problem. Developers building AI agents need a way to connect those agents to existing infrastructure without months of integration work.

MCPify fits that gap perfectly. It is the MCPify alternative to hand-rolled MCP servers --- faster, more thorough, and automatically kept in sync.

If you are building agents and tired of writing tool definitions by hand, give MCPify a try:

👉 Try MCPify Now

Final Thoughts

The era of AI agents is here. The question is whether your software is ready for them. With MCPify, you can make any application agent-ready in minutes, not weeks.

The pattern is simple: write your app as you normally would, run MCPify, and let AI agents interact with it naturally. No boilerplate, no endless configuration files, no brittle browser automation.

Give it a spin with npx mcpify-cli and let me know what you build.

Found this useful? Share it with a friend building AI agents. The project is open-source on GitHub, contributions welcome!