I replaced 2,000 lines of MCP boilerplate with one CLI command

Kyle Fuehri — Sat, 04 Apr 2026 18:40:19 +0000

The Problem

If you've ever wanted Claude, Cursor, or Copilot to talk to a REST API via MCP, you know the drill: write a transport layer, define tool schemas, handle OAuth, manage credentials, wrap errors... ~200 lines of boilerplate. Per API.

Want Claude to talk to Stripe AND GitHub AND Slack? That's 600+ lines before you've done anything useful.

What I Tried

Manual MCP servers — works, but painful at scale
Hosted MCP platforms — vendor lock-in, pricing concerns
Code generation — still need to maintain the output

Then I had a realization.

The Insight: OpenAPI Specs Already Have Everything

Stripe's OpenAPI spec is 50,000 lines. It describes every endpoint, parameter, auth scheme, and response shape. An MCP server needs exactly this information:

Endpoints (paths + methods) → MCP tools
Parameters (request schemas) → tool input schemas
Auth (securitySchemes) → OAuth/API key config
Base URLs (servers) → request routing

Why are we rewriting this by hand?

How APIFold Works

Point it at any OpenAPI or Swagger spec:

npx apifold serve stripe-openapi.yaml

That's it. 30 seconds later you have a production-ready MCP server. Claude, Cursor, or Copilot connect directly and make real HTTP calls.

What happens under the hood:

Parses OpenAPI 3.0/3.1 or Swagger 2.0
Generates MCP tool definitions from each endpoint
Handles auth — OAuth 2.0 with PKCE, API keys, Bearer tokens
Encrypts credentials in an AES-256-GCM vault
Serves via SSE or Streamable HTTP transport

The Registry

Pre-built configs for APIs you actually use:

Stripe
GitHub
Slack
Notion
HubSpot
Twilio
OpenAI

Growing weekly — submit a PR to add your API.

Security

This isn't a toy. Production features include:

OAuth 2.0 with PKCE — full authorization code flow with automatic token refresh
AES-256-GCM credential vault — credentials encrypted at rest
Per-request credential injection — keys never leak into tool definitions
Input validation — JSON Schema validation before every API call

Open Source

APIFold is open source:

Core transformer: MIT-licensed on npm
Full platform: AGPL-3.0

GitHub: github.com/Work90210/APIFold

What's Next

Registry expansion (community-driven)
Hosted version for teams
Webhook support for event-driven workflows

Try It

npx apifold serve your-api-spec.yaml

Website: apifold.dev

I'd love to hear: what APIs are you trying to connect your AI agents to? I'll add them to the registry.

I Built an Open-Source Tool That Turns Any REST API into an MCP Server — No Code Required

Kyle Fuehri — Sun, 22 Mar 2026 06:28:33 +0000

Every AI agent builder hits the same wall.

You want Claude, Cursor, or Copilot to call the Stripe API. Or the GitHub API. Or your company's internal API. So you sit down and write an MCP server — a bridge between your agent and the REST endpoint.

You write the tool definitions by hand. You map every parameter. You handle auth, rate limiting, error codes. You write tests. And then you do it all over again for the next API.

I got tired of writing glue code. So I built APIFold — an open-source platform that takes any OpenAPI spec and turns it into a live, production-ready MCP server endpoint. No code required.

Paste a spec URL. Get a working MCP server. Connect your agent.

The Problem in 30 Seconds

MCP (Model Context Protocol) is how AI agents talk to external tools. It's a great standard — but connecting a REST API to MCP today means:

Reading the API docs
Manually defining every tool (endpoint) with its parameters
Writing the HTTP proxy logic
Handling authentication injection
Adding rate limiting, circuit breakers, error handling
Deploying and maintaining the server

For one API, that's a weekend project. For ten APIs, it's a full-time job.

What APIFold Does

APIFold automates every step:

# Self-hosted: one command
docker compose up -d

# Or use the hosted version at apifold.dev

Step	What Happens
1. Import	Paste your OpenAPI/Swagger spec URL or upload a file
2. Transform	APIFold parses every operation, resolves `$ref` chains, handles `allOf`/`oneOf`/`anyOf` composition, and generates MCP tool definitions
3. Connect	You get a live SSE endpoint — point Claude Desktop, Cursor, or any MCP client at it

That's it. Your agent can now call every endpoint in the API.

What's Under the Hood

APIFold is a TypeScript monorepo with four components:

1. The Transformer (`@apifold/transformer`)

The core engine is an MIT-licensed npm package. It's a pure function — no side effects, no network calls, no runtime dependencies. Feed it an OpenAPI 3.0/3.1 spec, get back MCP tool definitions.

import { parseSpec } from '@apifold/transformer';

const spec = await fetch('https://api.example.com/openapi.json')
  .then(r => r.json());

const tools = parseSpec(spec);
// → Array of MCP tool definitions with inputSchema,
//   parameter mapping, and metadata

It handles the gnarly stuff:

Circular $ref resolution with cycle detection
Schema composition (allOf, oneOf, anyOf)
Operation name sanitization and collision deduplication
Parameter mapping across path, query, header, and request body

Tested against 10+ real-world API specs (Stripe, GitHub, Twilio, OpenAI, and more) with 95%+ coverage.

You can use the transformer standalone — it's MIT licensed and works in browsers, Node, edge runtimes, wherever.

2. The MCP Runtime

An Express server that hosts live MCP endpoints. For each server you create, you get:

GET  /mcp/my-stripe-server/sse          # SSE connection
POST /mcp/my-stripe-server/sse/message  # Tool calls

What it handles for you: credential injection, per-server rate limiting (Redis-backed sliding window), circuit breakers for upstream resilience, and hot-reload via Redis pub/sub — no restarts needed.

Internally, it uses a tiered context loading architecture: L0 in-memory registry for hot servers, L1 tool cache, L2 credential cache. This keeps memory predictable even at scale.

3. The Dashboard

A Next.js 15 app where you manage everything:

Import specs from URL or file
Configure servers — auth mode, base URL, rate limits
Enable/disable individual tools per server
Test tool calls in an interactive console with JSON Schema form generation
View request logs with filtering and syntax highlighting
Export standalone code — generate a self-contained TypeScript MCP server you can deploy anywhere

4. Security Built In

Concern	How It's Handled
Credentials	AES-256-GCM encryption at rest (PBKDF2-derived keys)
SSRF	DNS resolution checks + private IP blocking on spec URL fetching
SQL Injection	Parameterized queries via Drizzle ORM
Access Control	Row-level filtering by `userId` on every query
Rate Limiting	Dual-layer — nginx (per-IP) + application (per-server)
Scanning	Trivy, gitleaks, and npm audit in CI

The Tech Stack

Layer	Choice
Framework	Next.js 15 (App Router) + Express
Database	PostgreSQL 16 + Drizzle ORM
Cache / PubSub	Redis 7
Auth	Clerk
Billing	Stripe
UI	Shadcn/UI + Tailwind
Docs	Fumadocs (MDX, integrated at `/docs`)
Testing	Vitest + Playwright (55+ E2E tests)
CI/CD	GitHub Actions + Docker + GHCR
Deploy	Docker Compose + nginx (SSE-optimized)

Self-Host or Use the Cloud

APIFold runs on a single ~$5/month VPS:

# docker-compose.yml (simplified)
services:
  web:
    image: ghcr.io/work90210/apifold-web:latest
    ports: ["3000:3000"]

  runtime:
    image: ghcr.io/work90210/apifold-runtime:latest
    ports: ["4000:4000"]

  postgres:
    image: postgres:16-alpine

  redis:
    image: redis:7-alpine

  nginx:
    image: nginx:alpine
    ports: ["80:80", "443:443"]

One docker compose up -d and you own the entire stack. No vendor lock-in, no data leaving your infrastructure.

Or use the hosted version:

Plan	Servers	Requests/mo	Log Retention	Price
Free	2	1,000	7 days	Free
Starter	10	50,000	30 days	$9/mo
Pro	Unlimited	500,000	90 days	$49/mo
Enterprise	Unlimited	Custom	Custom	Contact us

What's Coming Next

The v1 launch covers the full loop: import > configure > connect > test > export. But the roadmap has 10 more features planned:

CLI Tool

# Zero-config quick start — no dashboard needed
npx apifold serve ./stripe-openapi.yaml

# With options
apifold serve ./spec.json \
  --port 3001 \
  --base-url https://api.stripe.com \
  --auth-header "Authorization: Bearer $STRIPE_KEY" \
  --filter-tags payments,customers

A lightweight local MCP server that runs from a spec file. No database, no Redis — just the transformer and an Express server. Available via npm, Homebrew, and standalone binaries.

OAuth 2.0 Support

Today APIFold handles API keys and bearer tokens. OAuth 2.0 is next — with PKCE, automatic token refresh, and pre-configured presets for:

Google | Slack | GitHub | Salesforce | HubSpot | Microsoft Graph | Notion | Spotify

You supply your client ID/secret. APIFold handles the dance.

Spec Registry

A curated catalog of pre-validated API specs. Browse a grid of API cards, click "Deploy Stripe", enter your API key, and have a live MCP server in under 30 seconds.

Community contributions welcome.

Analytics Dashboard

The data is already being collected. The analytics dashboard will surface it:

Time-series charts — call volume over 24h / 7d / 30d
Latency percentiles — p50, p95, p99
Error explorer — filter by error code, inspect failed requests
Per-tool breakdown — which tools get called most, which are slow
CSV export — bring your own BI tools

Webhook-to-MCP Bridge

This is the feature I'm most excited about.

Many APIs are event-driven — Stripe webhooks, GitHub push events, Slack messages. APIFold will map OpenAPI 3.1 webhooks to MCP resources and notifications. Your agent will be able to subscribe to real-time events, not just make requests.

# Agent receives real-time notification when a payment succeeds
webhook://stripe/payment_intent.succeeded

Per-provider signature validation included (Stripe, GitHub, Slack).

Multi-Spec Composition

A "CRM agent" needs HubSpot + Slack + your internal API. Today, that's three separate MCP connections. Composite servers merge tools from multiple specs into a single endpoint:

# One MCP endpoint. One connection. All your APIs.
stripe_getCustomer
stripe_listInvoices
hubspot_getContacts
hubspot_getDeals
slack_postMessage

Drag-and-drop builder in the dashboard. Each tool retains its own upstream URL and credentials.

More on the Roadmap

Feature	What It Does
Swagger 2.0 auto-conversion	Paste a Swagger 2.0 spec — it auto-converts transparently
Access control profiles	"Read Only" shows only GET tools, "Billing" shows only charges + invoices
Response schema mapping	Tools include return type metadata for better agent chaining
Streamable HTTP transport	Stateless JSON-RPC endpoint for serverless deployment (Vercel, Lambda)

Why Open Source?

The transformer is MIT — use it anywhere, no strings attached.

The platform is AGPL-3 — self-host freely, but you can't build a closed-source competing SaaS on top of it. A commercial license is available for orgs that need proprietary modifications.

I believe the best developer tools are open source. You can read every line of code, audit the security model, run it on your own infrastructure, and contribute improvements back.

Try It


GitHub	github.com/Work90210/APIFold
npm	`npm install @apifold/transformer`
Self-host	`docker compose up -d`
Docs	Available at `/docs` in any running instance

If you're building AI agents and tired of writing MCP servers by hand, give APIFold a try. Star the repo if it's useful — it helps more than you'd think.

Which upcoming feature matters most to you? Drop a comment below — it directly influences what I build next.

DEV Community: Kyle Fuehri

I replaced 2,000 lines of MCP boilerplate with one CLI command

The Problem

What I Tried

The Insight: OpenAPI Specs Already Have Everything

How APIFold Works

What happens under the hood:

The Registry

Security

Open Source

What's Next

Try It

I Built an Open-Source Tool That Turns Any REST API into an MCP Server — No Code Required

The Problem in 30 Seconds

What APIFold Does

What's Under the Hood

1. The Transformer (@apifold/transformer)

2. The MCP Runtime

3. The Dashboard

4. Security Built In

The Tech Stack

Self-Host or Use the Cloud

What's Coming Next

CLI Tool

OAuth 2.0 Support

Spec Registry

Analytics Dashboard

Webhook-to-MCP Bridge

Multi-Spec Composition

More on the Roadmap

Why Open Source?

Try It

1. The Transformer (`@apifold/transformer`)