Convert an OpenAPI API into an MCP server
Updated October 24, 2026
Voozeo MCP converts an OpenAPI 3.0 or 3.1 specification into a hosted MCP server: each API operation becomes a tool that Claude, ChatGPT, Cursor or any MCP client can call, with no code to write and no server to run.
How the conversion works
- Create a server in Voozeo and open its "Sources" tab.
- Choose "Import an OpenAPI spec", then send the file or give the public HTTPS address of the spec.
- Voozeo reads the spec and generates one tool per operation, with its name, its description and its parameters.
- Check the tools, set the target API and its authentication, then try a tool in the sandbox.
- Paste the server URL and the MCP key into your AI client. See how to connect your AI.
Re-import a newer version of the spec at any time: your renamed tools and rewritten descriptions are kept for operations that still exist. See updating the spec.
What becomes a tool
| In the OpenAPI spec | In the MCP server |
|---|---|
Operation (operationId, or method and path) | One tool |
summary, then description | Tool description, which you can rewrite |
| Path, query, header and JSON body parameters | Tool arguments |
| GET, HEAD, OPTIONS | Read-only tool |
| POST, PUT, PATCH | Write tool, flagged as changing data |
| DELETE | Delete tool, flagged as destructive |
Only JSON request bodies are exposed. The write and delete flags are passed to the AI client as MCP annotations, which encourages it to ask for confirmation. See choosing and describing tools.
What Voozeo accepts
| Item | Value |
|---|---|
| Specification versions | OpenAPI 3.0.x and 3.1.x (Swagger 2.0 is rejected with UNSUPPORTED_SPEC_VERSION) |
| File formats | JSON or YAML (.json, .yaml, .yml) |
| Maximum size | 5 MB, for a file or a URL |
References ($ref) | Local references only, such as #/components/schemas/Order |
| Spec from a URL | Public HTTPS address; private and internal addresses are refused (UNSAFE_URL) |
An invalid or empty spec fails with INVALID_SPEC. A file above the size limit fails with FILE_TOO_LARGE. Warnings that do not block the import, such as an ignored external reference, are listed in the "Sources" tab. See importing an OpenAPI API.
How your API is called
When an AI uses a tool, Voozeo calls your API from the base URL found in the spec (or the one you enter in the "Target API" tab) and returns the response to the AI.
| Authentication | What you provide |
|---|---|
| None | Nothing, for public APIs |
| API key | Header or query parameter name, and the secret |
| Bearer token | The token, sent in the Authorization header |
| Basic | Username and password |
| OAuth 2.0 | The OAuth app created at your API provider: client ID, client secret, authorization and token URLs, scopes |
| Forwarded by caller | Only a header name: the value comes from each MCP call, for example from an OAuth gateway, and nothing is stored |
With OAuth 2.0, each person signs in with their own account at your API provider and no MCP key is needed; Voozeo calls your API with that person's token. The secret is stored encrypted, can never be read again and is never given to the AI. Responses longer than 100 KB are truncated before they reach the AI. To give each user their own credential without OAuth at the provider, see per-user credentials with an OAuth gateway. See target API and authentication.
Limits by plan
The number of active tools per server depends on your plan.
| Plan | Servers | Active tools per server |
|---|---|---|
| Free | 1 | 50 |
| Starter | 3 | 100 |
| Pro | 10 | 300 |
| Business | 30 | 500 |
When a spec has more operations than your plan allows, the first tools in the spec order are enabled and the others are disabled. See pricing for all limits.
Next steps
- Try a ready-made server first with a template.
- Follow the guide from a REST API to an MCP server in 5 minutes.
- Read how to secure an AI's access to your API.
- New to the protocol? Read what is MCP.