OpenAPI-MCP turns an existing OpenAPI spec into MCP tools, with a deny-by-default allowlist

OpenAPI-MCP is a Python proxy that takes an existing OpenAPI document and registers its operations as Model Context Protocol tools. It is built on FastMCP for transport and tool registration, and also exposes schema resources, a usage prompt, and request previews so a client can inspect what will be called before anything is executed. The intended audience is a team that already maintains an OpenAPI-described service and wants an MCP surface without hand-writing a separate tool layer for each endpoint. That makes it most relevant for internal APIs, partner APIs, and prototypes where the specification is already the contract. The proxy accepts a local JSON or YAML file or an HTTP(S) URL via OPENAPI_URL, and the README is explicit that only specifications and endpoints you trust should be used. A deny-by-default exposure model The most consequential design choice is the default policy: no API operations are exposed until you name them. MCP_ALLOWED_OPERATIONS takes a JSON array of exact uppercase method and path pairs from the specification, such as GET /pets or GET /pets/{petId}. Selectors are literal matches, not regular expressions or wildcards, and they use the specification path without the server URL or base path. Startup is strict about that list. An unknown selector, a malformed list, a duplicate, or a conflicting policy stops the server instead of starting with a partial surface. Only permitted operations appear as tools, in the operation list, and in the usage prompt, and a direct call to an omitted tool is rejected before request preparation or authentication. An empty list leaves only information tools, the usage prompt, and schema resources available. Operation IDs that collide after name sanitization, or that collide with management tool names, are rejected rather than silently replacing a tool. That control has clear limits. Setting MCP_OPERATION_POLICY=all restores exposure of every operation when MCP_ALLOWED_OPERATIONS is unset. The policy applies to the whole server instance, not to individual users, so changing it requires a restart with a new instance. Descriptions and component schemas remain available as metadata, so the allowlist is not a document-redaction feature. A GET-only list also is not a guarantee that an operation is harmless; the README advises