Turn any API into an MCP server
The integration that matters most to your team is usually the one only you have. Point the converter at its schema and get a typed MCP connector with auth wired in, internal services included.
vectorhub api-to-mcp create \
--name internal-billing \
--spec ./openapi.yaml \
--base-url https://billing.internal.acme.com \
--auth basic
✓ parsed 46 operations
✓ generated 46 tools
⚠ 7 descriptions flagged as too thin
⚠ 3 destructive operations disabled by default
✓ connector "internal-billing" published (private)Most of an MCP server is mechanical
An OpenAPI document already contains nearly everything a tool definition needs. The converter does the translation; you make the three judgement calls that actually matter.
operationId→tool namesummary + description→tool descriptionparameters + requestBody→input JSON Schemaresponses→output shapesecuritySchemes→auth bindingSchema in, connector out
Four steps, and only one of them needs your attention for more than a minute.
Point it at a schema
Upload an OpenAPI document, paste a GraphQL introspection URL, or import a Postman collection. Internal and undocumented APIs can be described endpoint by endpoint.
Review the generated tools
You get a tool per operation with inferred names, descriptions and JSON Schemas. The converter flags thin descriptions, loose parameters and destructive operations for a human decision.
Attach authentication
Auth is read from securitySchemes where present. Fill in the credential once and it goes straight into the vault, never into the connector definition.
Publish and scope
The connector goes live behind the same gateway as every managed one, with the same key scoping, logging and rate-limit handling.
Where naive generation goes wrong
A tool set generated without judgement is technically correct and unusable. These are the three things the converter refuses to guess at.
Descriptions written for humans
'Updates the resource' teaches a model nothing. Thin descriptions are flagged with a suggested rewrite, because tool descriptions are the entire basis on which a model decides to call something.
Destructive operations
DELETE /v1/customers/{id} generates as cleanly as a GET. It should not be equally reachable. Destructive tools are disabled until you enable them deliberately.
Unbounded parameters
A free-form filter string is a bug waiting to happen when the caller is a language model. Loose schemas are flagged so you can narrow them to enums and ranges.
Your internal API, callable from any agent
Once published, a generated connector is indistinguishable from a managed one: same scoping, same audit trail, same single key.
> What's the on-hand stock for SKU AC-9920 in Singapore?
⚒ internal-billing.customer.lookup 142ms
⚒ legacy-warehouse.warehouse.stock.check 208ms
AC-9920 has 412 units on hand in Singapore (sgp),
with 96 allocated to open orders, so 316 available.Converter questions
What inputs does the converter accept?
OpenAPI 3.x and Swagger 2.0 documents, GraphQL SDL or an introspection endpoint, Postman collections, and manual endpoint definitions for APIs with no machine-readable schema.
Do I have to expose my internal API to the internet?
No. Private connectors can reach services inside your network through an outbound-only tunnel agent, or the whole gateway can run inside your VPC on enterprise plans.
How does it decide which endpoints become tools?
Every operation is generated, then ranked. Operations that map to real tasks are exposed by default; the rest stay addressable but unranked so a 400-endpoint API does not produce 400 competing tools.
Can I edit the generated tools?
Yes, and you should. Descriptions, parameter constraints and destructive-operation flags are all editable, and edits survive re-generation when you update the source schema.
Is the generated connector private to my organisation?
By default, yes. You can optionally publish a connector to your team, or submit it for inclusion in the public catalog.
Bring your own API
Upload a schema and see the generated tool set before you commit to anything.
No credit card required · Free tier available · Self-host on request