What is mcp-openapi-proxy AGENTS.md?

Project instructions for a Go command-line server that turns OpenAPI 3.x descriptions into an MCP server.

Use it when developing a server that lists, describes, and calls API endpoints from an OpenAPI document through MCP.

It explains how the specification is parsed, how endpoint tools are named, and how requests, authentication, responses, and limits are handled.

mcp-openapi-proxy AGENTS.md — Instructions file by rendis

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods

npx agentmods add instructions/rendis/mcp-openapi-proxy/agents-md

Clone the repo

git clone --depth 1 https://github.com/rendis/mcp-openapi-proxy

Made for: Codex, OpenCode.

Per session 1,804 This file is loaded in full into every session.

When invoked 1,804 The same file — it is already loaded in full.

Security scan B 1 finding. Scan, not verified.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5	$0.01804	$0.01804
Opus 5	$0.00902	$0.00902
Sonnet 5	$0.00361	$0.00361
Haiku 4.5	$0.00180	$0.00180

Measured yesterday against content hash ed66b61704c3, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade B, and why

mcp-openapi-proxy AGENTS.md scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Reads agent configuration directoriesmediumAgent snooping

.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.

- Claude Code uses `.mcp.json`; Codex global install uses `codex mcp add <name> ... -- mcp-openapi-proxy`; Codex project-local config is manual in `./.codex/config.toml`

AGENTS.md · 81 lines

How it starts

The opening of the file, as written. The whole thing — 81 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Agent Instructions

Project

Go CLI that converts OpenAPI 3.x specs into a lightweight MCP stdio navigator/executor — 3 MCP tools plus indexed endpoint toolName identifiers, no codegen.

Architecture

cmd/mcp-openapi-proxy/main.go — CLI entry point, env var parsing, subcommands: serve/login/logout/status
pkg/spec/model.go — internal OpenAPI model types: endpoints, params, media types, security, servers
pkg/spec/parser.go — OpenAPI 3.x parser (kin-openapi), validates the spec and extracts Endpoint structs
pkg/server/server.go — MCP server setup, stdio transport
pkg/server/generator.go — endpoint toolName / path sanitization helpers
pkg/server/navigator.go — endpoint index plus the 3 registered MCP tools: list/describe/call
pkg/server/schema.go — JSON Schema generation for the lightweight navigator tool inputs plus response helpers
pkg/server/runtime.go — request serialization, auth application, HTTP execution, MCP envelope responses
pkg/client/client.go — HTTP client execution, content-type aware decoding, response body limits
pkg/client/errors.go — client transport/body limit errors
pkg/auth/provider.go — TokenProvider interface + StaticTokenProvider
pkg/auth/resolver.go — resolves OpenAPI security requirements to concrete HTTP auth material
pkg/auth/oidc_provider.go — OIDC token storage, auto-refresh (30s margin)
pkg/auth/discovery.go — OIDC .well-known/openid-configuration endpoint discovery
pkg/auth/login.go — Browser-based OIDC Authorization Code + PKCE flow
pkg/auth/logout.go — Token file removal
pkg/auth/status.go — Auth state display

Key Dependencies

github.com/getkin/kin-openapi — OpenAPI 3.x parsing
github.com/modelcontextprotocol/go-sdk — MCP server (go-sdk v0.4.0)
github.com/google/jsonschema-go — JSON Schema for tool inputs

Build & Run

Install latest binary: go install github.com/rendis/mcp-openapi-proxy/cmd/mcp-openapi-proxy@latest
go build -C . -o bin/mcp-openapi-proxy ./cmd/mcp-openapi-proxy
Config is 100% env vars: MCP_SPEC, optional MCP_BASE_URL, MCP_TOOL_PREFIX, MCP_AUTH_PROFILE, MCP_AUTH_TOKEN, MCP_OIDC_ISSUER, MCP_OIDC_CLIENT_ID, MCP_OIDC_SCOPES, MCP_EXTRA_HEADERS, MCP_MAX_BODY_BYTES, MCP_ALLOW_INSECURE_HTTP, MCP_EXCLUDE_DEPRECATED, plus MCP_AUTH_<SCHEME>_*
Claude Code uses .mcp.json; Codex global install uses codex mcp add <name> ... -- mcp-openapi-proxy; Codex project-local config is manual in ./.codex/config.toml
Static token path: put MCP_AUTH_TOKEN in the MCP client config entry
OIDC login examples:
- mcp-openapi-proxy login
- mcp-openapi-proxy login my-api
- mcp-openapi-proxy login --mcp-config ./path/to/.mcp.json
- mcp-openapi-proxy login --mcp-config ./path/to/.mcp.json --server my-api
- mcp-openapi-proxy login --codex-server my-api
- mcp-openapi-proxy login --codex-config ~/.codex/config.toml
- mcp-openapi-proxy login --codex-config ~/.codex/config.toml --server my-api

Read the full file on GitHub · 81 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

yesterday First seen · 81 lines · 1,804 tokens per session scan B ed66b61704c3

Subscribe to this mod's changes

mcp-openapi-proxy AGENTS.md is an instructions file published in the GitHub repository rendis/mcp-openapi-proxy (1 stars, last pushed 4mo ago), licensed MIT. It adds 1,804 tokens to every session, about $0.0090 per session on Opus 5. A static security scan graded it B with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Backend and APIs Data and AI Documents ai-agents claude-code codex gemini-cli go mcp

azure-sdk-for-go go-code.instructions.md

Instructions for Azure/azure-sdk-for-go: All code should follow the guidelines from the Azure Go SDK Guidelines. This document is a summary of the most important guidelines to follow when contributing to the Azure Go SDK.

Azure/azure-sdk-for-go · 755 tokens

chatgpt-cli CLAUDE.md

Instructions for kardolus/chatgpt-cli, covering chatgpt-cli — release runbook, prerequisites, 1. cut the release, 2. publish the github release + binaries and 3. update the homebrew tap.

kardolus/chatgpt-cli · 1,279 tokens

Sighthound AGENTS.md

Instructions for Corgea/Sighthound, covering claude, commands, python / django test naming and agent skill.

Corgea/Sighthound · 847 tokens

klaudiush CLAUDE.md

Instructions for smykla-skalski/klaudiush, covering claude.md, project overview, commands, completion (shell completion scripts) and doctor (diagnose setup and configuration).

smykla-skalski/klaudiush · 5,328 tokens

gemini-cli-desktop AGENTS.md

Instructions for Piebald-AI/gemini-cli-desktop, a project described as: Web/desktop UI for Gemini CLI/Qwen Code. Manage projects, switch between tools, search across past conversations, and manage MCP servers, all from one multilingual interface, locally or remotely.

Piebald-AI/gemini-cli-desktop · 6 tokens

rag-code-mcp copilot-instructions.md

Instructions for doITmagic/rag-code-mcp, covering copilot instructions - ragcode mcp, ⚖️ the golden rule, project overview, architecture & patterns and developer workflows.

doITmagic/rag-code-mcp · 568 tokens

mcp-openapi-proxy AGENTS.md