How do I convert my REST or GraphQL API into an MCP server?
Open My MCP → New MCP. Paste your OpenAPI 3.x spec URL (or document) or your GraphQL endpoint with introspection enabled. CMD+K scans the schema, generates one typed MCP tool per operation, lets you pick exactly what AI may touch, and publishes a stable MCP URL your customers can connect to from Claude, Cursor, or any MCP client. No server code required.
What do I need?
- An OpenAPI 3.x spec (URL or document) or a GraphQL endpoint with introspection enabled.
- Optionally, a token that can read your schema — used for scanning and re-sync only.
- A CMD+K workspace (free tier is fine: one endpoint, 2,500 requests/month).
Step-by-step
- Open the wizard. Dashboard → My MCP → New MCP.
- Point it at your API. Choose GraphQL or OpenAPI. Paste your GraphQL endpoint URL (introspection on) or your OpenAPI 3.x spec URL — or paste the OpenAPI document directly. If your API requires auth to read the schema, add a setup token; it's used for scanning and re-sync only.
- Scan. Optionally hit Test connection (we auto-detect Bearer vs Basic), then Scan API. We list every operation we found.
- Pick what AI can touch. Tools are classified as reads, writes, and destructive. Safe reads are pre-selected; destructive operations are never auto-selected. Search, filter by category, and select exactly the surface you want to expose.
- Publish. Name your MCP, confirm the public slug, choose how your customers authenticate (their own API keys is the recommended default), then Publish MCP to the public — or Save as draft. Tool descriptions are auto-written for AI clients on publish.
Which customer auth mode should I pick?
- Customers use their own API keys (recommended). Each customer connects with the key they already have with your product; every call runs under their own account. The true gateway mode — works with any API that supports keys.
- Customers sign in with your OAuth. Same per-customer identity via your OAuth server — pick this if your API uses OAuth instead of keys.
- Shared access token. Internal/team edge case: all callers share your stored token and your API can't tell them apart. Not for customer-facing MCPs.
- No authentication. Demos and genuinely public data only.
Full details — including the customer connect flow and revocation — are in the authentication guide.
Example: OpenAPI from FastAPI
If you're on FastAPI, paste this URL into the wizard:
bash
# Your FastAPI app exposes this for free
https://api.example.com/openapi.jsonTip: descriptions drive tool-call accuracy
The LLM reads each tool's
description to decide when to call it. We auto-write AI-friendly descriptions on publish, and you can refine any of them (or re-run the AI rewrite) from the deployment's Setup → Tools section.Next steps
FAQ
- What spec formats are supported?
- OpenAPI 3.x (JSON or YAML, by URL or pasted document) and GraphQL via introspection. If your API isn't documented yet, generate a spec first — e.g. FastAPI's built-in /openapi.json, or swagger-jsdoc for Express.
- How is auth forwarded to my upstream API?
- In the recommended per-customer modes, each customer connects with their own API key or OAuth account and every call carries their credential — your API sees them like normal traffic. A shared-token mode exists for internal tools. See the authentication guide for details.
- Can I rename or hide generated tools?
- Yes. The Tools step lets you select exactly which operations are exposed, and after publishing you can edit each tool's AI-facing description (or let AI rewrite them) from the deployment's Setup tab. Descriptions are what the LLM reads to decide when to call a tool, so good ones matter.
- What URL do my customers use?
- Your MCP is served at commandplusk.com/api/public/mcp/d/<slug>. On paid plans you can attach a custom domain like mcp.yourcompany.com — customers see your brand, not ours.
- What happens when my API changes?
- Run Re-sync from the deployment's Setup tab: we re-fetch your schema, show you a diff of added/removed/changed tools, and warn you if the source is shared by other deployments. Pin a version (…/d/<slug>@v2) to keep a stable surface for existing clients.