OpenAPI to MCP converter

What it does

Paste an OpenAPI 3.0 or 3.1 document, or open one — JSON or YAML — and get the tools an MCP server would list for it, as a tools/list result ready to copy. Each operation becomes one tool. Everything that did not convert, or converted in another form, is listed with its path.

Try it: the OpenAPI Petstore, or an API with parts that do not convert.

How it converts

• Description is the operation's summary and description; the title is its summary. An operation with neither gets its method and path, and a warning.
• inputSchema is one object: a property for each path, query and header parameter, and the request body under body. When two parameters share a name, the second is named after where it goes — query_id — or query_id_2 if that name is taken too, so no argument is overwritten. Path parameters are always required; the others when they say so, and the body when required: true. It is closed with additionalProperties: false.
• A schema is written as JSON Schema: OpenAPI 3.0's nullable: true becomes a type list with "null", its boolean exclusiveMinimum and exclusiveMaximum become numbers, example becomes examples, and discriminator (reported, since JSON Schema has no such keyword), xml, externalDocs and x- extensions are left out.
• Annotations, when you ask for them, come from each method's semantics in RFC 9110: GET, HEAD, OPTIONS and TRACE are readOnlyHint: true; DELETE is destructiveHint and idempotentHint; PUT is idempotentHint. They are this converter's reading of the method, not a statement by the API, and off by default.

Names

The operationId is kept when it fits the chosen rule — the MCP specification's (1 to 128 letters, digits, _, - and .) or Salyro's model-facing names (^[a-zA-Z0-9_-]{1,64}$, which Salyro takes as what its four providers all accept). Otherwise the tool's own characters are replaced by _ and cut to the limit, and a name already taken gets _2, _3: the principle Salyro's MCP Connect uses for the names a model sees. An operation with no operationId is named from its method and path.

References

$ref is resolved inside the document only. A reference to another file or a URL is not followed — that would be a network call — and the schema accepts anything in its place, with a warning. A schema that contains itself, such as a tree, is kept once in the tool's $defs.

What is not converted

• Cookie parameters, which are the client's state, not arguments.
• Header parameters named Accept, Content-Type or Authorization, which the OpenAPI specification says SHALL be ignored.
• Security schemes, and an operation's own security. A credential belongs in the MCP server's configuration, never in a tool's arguments, where the model would write it.
• servers. The address is the MCP server's configuration, not an argument the model chooses.
• File uploads (format: binary) and a body only in a media type a model cannot write. Form bodies are converted as an object the server encodes.
• readOnly properties, which are sent in responses, not requests.
• Callbacks and webhooks, which are requests the API makes, not operations a caller makes.
• A request body with no content, which has no schema, and a parameter whose in is none of path, query, header or cookie.
• A document whose tools would be more than about 2 MB of text. YAML aliases and $refs that fan out can make a small document expand many times over, and a result that large cannot be shown or copied here, so nothing is converted and the page says how large it would have been. Convert a part of the document instead.
• Swagger 2.0, and a path item that is itself a $ref.

What it does not know

• Whether the API behaves as the document says, or whether the result works as a server. It writes definitions; it runs nothing.
• Responses: an MCP tool's outputSchema is not written from them.
• Anything behind an external $ref, or a document at a URL — loading one is outside what runs in the page.

FAQ

Why is the request body under body and not merged into the arguments?

A body property and a parameter can share a name, and merging them would silently drop one. Under body the whole body is one argument, as the server has to send it.

Is my document uploaded?

No. It is read in your browser. YAML is read by a small library that loads only when the document is not JSON. A share link carries the settings, never the document.

Sources

The MCP naming rule is the specification's, recorded as Reference Data. The rules about headers, readOnly, nullable and references are the OpenAPI Specification 3.0 and 3.1, and the method semantics RFC 9110 §9.2. The Petstore example is from the OpenAPI Initiative's specification repository, under its Apache License 2.0; the other example was written for this tool.