Watchlist tracking
Reviewed for relevance and future tracking value.
MCP100 Assessment
Watchlist / Tracking
Why we’re tracking it
Track schema translation and auth behavior as OpenAPI integrations evolve
Reviewed · Documentation review; complete setup workflow not independently tested
Best fit
Plain-language discovery of public OpenAPI specifications
What we know
Read-oriented MCP service for searching/exploring OpenAPI specs through oapis.org.
Maintenance / activity evidence
- Observed (UTC)improvements
Tracking evidence observed Oct 5, 2026. These dated signals do not establish current maintenance. Reviewed enrichment confidence: high.
Verification gaps / watch-outs
- Installation and comprehensive security have not been independently audited.
- Read OpenAPI specs via oapis.org.
- None documented.
- Sensitive access: Potential API specification content
- Read-oriented service with no documented mutation surface.
Full authority, access and evidence limits are available in Review context and Access & risk.
Popularity
903 repository stars
Stars observed Oct 6, 2026.
No canonical package metric applied.
No canonical package metric applied.
No canonical package metric applied.
All limitations / Review context
How does the current server map OpenAPI operations and credentials to MCP tools?
The bounded assessment reviewed the official README, repository notices, security policy path, and security page for known material public-tracking blockers. No such blocker was identified. This is a public-tracking assessment, not an installation safety certification.
- Read-oriented service with no documented mutation surface.
- Read OpenAPI specs via oapis.org.
- None documented.
- Specification content returned to client.
- Sensitive access: Potential API specification content
- Installation, client compatibility and comprehensive security have not been independently audited. Authentication and access depend on the configured services.
- A project-specific SECURITY.md policy was not available at the fetched official path; the review remains limited to published repository notices.
- No installation, runtime, client matrix, or complete tool-contract audit was performed in this review.
- The fetched official SECURITY.md path returned HTTP 404; it was not treated as positive evidence.
- Hosted endpoint is the primary documented access path.
- No auth is documented.
Original activity observations
- 2026-07-07T15:21:08Z: improvements
Technical identity
github.com/janwilmake/openapi-mcp-server- Exact implementation source
- https://github.com/janwilmake/openapi-mcp-server ↗
- Reviewed resource type
- Gateway
- Repository identity
- janwilmake/openapi-mcp-server
- Service endpoint
- https://openapi-mcp.openapisearch.com/mcp
Evidence & Sources
- Evidence basis
- Recorded source evidence
- Setup runtime verification
- Not independently runtime-tested by MCP100 for this setup workflow.
Reviewed · Latest source observation
- GitHub repository ↗
janwilmake/openapi-mcp-server
Recorded repository material and project history.
Setup · Watchlist
Self-hosted gateway service setup
Publisher instructions.
Source evidence observed .
Additional setup details required — see the specific gaps below.
Install / connect
MCP100 setup guideConnect remote MCP URL `https://openapi-mcp.openapisearch.com/mcp` using your MCP client’s remote HTTP connector; the publisher README offers the `installthismcp.com` setup link rather than a local npm command.
Claude Code remote HTTP example (client-composed from publisher endpoint): `claude mcp add --transport http openapi-mcp https://openapi-mcp.openapisearch.com/mcp`.
Configure / authenticate
Publisher instructionsPublisher offers hosted OpenAPI MCP at https://openapi-mcp.openapisearch.com/mcp; no verified local server package should be asserted on the basis of this short README.
Check connection
Suggested checkCheck client tool discovery and use only a non-mutating discovery operation.
Remove / uninstall / revoke
MCP100 setup guideOnly if the remote URL was registered under openapi-mcp using Claude Code; otherwise remove https://openapi-mcp.openapisearch.com/mcp in the client connector settings. No local npm program.
Distinguish client registration removal from software uninstall, persistent data deletion and provider OAuth/API-key revocation.
claude mcp remove openapi-mcp
What it does
Read-oriented MCP service for searching/exploring OpenAPI specs through oapis.org.
- Capability
- Search & Web
- Resource type
- Gateway
- Best fit
- Plain-language discovery of public OpenAPI specifications
Representative uses
- Get spec overview
- Retrieve operation details
- Work with JSON/YAML specs
Limitations
- Hosted endpoint is the primary documented access path.
- No auth is documented.
Reviewed access
Access & risk
Review the exact access boundary before connecting this MCP to accounts, credentials, or sensitive data.
- Authentication
- None documented.
- Permissions
- Read OpenAPI specs via oapis.org.
- Data handling
- Specification content returned to client.
- Cost
- unknown
- Risk and cautions
- Read-oriented service with no documented mutation surface.
Access scope and cautions
- Write actions
- None in the reviewed inventory
- Sensitive access
- Potential API specification content
- Risk level
- low
FAQ
Based on reviewed evidence as of 2026-10-06. Watchlist tracking is not a recommendation or a security certification.
Which tasks are documented for this implementation?
What setup and authentication are documented?
Can it modify data or perform write operations?
What data-handling boundary should I consider?
What limitations and risks should I check before use?
Is this an official MCP?
janwilmake is listed as Community implementation in MCP100’s current evidence.