# Muhammed-AbdelGhany/rest_api_mcp [Health: Active]

**Category:** 💻 Developer Tools  
**Repository:** https://github.com/Muhammed-AbdelGhany/rest_api_mcp  
**GitHub Stars:** 6  
**npm Downloads (last month):** 61  
**Views:** 1  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/muhammed-abdelghany-rest-api-mcp

## Description
MCP server for authenticated REST API calls — auto-login, token caching, 2FA/OTP support, Swagger spec fetch, and fuzzy endpoint search. Works with any REST API without writing auth code.

## Tools
Capabilities this server exposes over MCP:

- **search_endpoints** — Fuzzy-search the API spec by keyword. Returns matching endpoints with method, path, summary, tags, and required parameters. **Use this before `request` when you don't know the exact path.**
- **describe_endpoint** — Returns the full OpenAPI schema for a **single endpoint**: parameters, request body schema (with types, required flags, enums, examples), response schemas, and a **generated example request body**. Use this before `request()` when you need to know exactly what fields to include in the body or what…
- **request** — Make an authenticated API call. Handles login automatically — re-logins transparently if the token is expired.
- **inspect_login** — Performs the login flow (and optional 2FA verify) and returns the **raw server responses** without extracting a token. Also returns **heuristic suggestions** for:
- **fetch_spec** — Fetch the full OpenAPI/Swagger JSON spec for schema inspection, DTO discovery, or understanding available endpoints.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "rest-api-mcp": {
    "command": "npx",
    "args": ["-y","rest-api-mcp"],
    "env": {
      "REST_BASE_URL": "",
      "API_EMAIL": "",
      "API_PASSWORD": ""
    }
  }
}
```

**Requires environment variables:** `REST_BASE_URL`, `API_EMAIL`, `API_PASSWORD` — the values above are empty placeholders; fill in real credentials before running (see the repository for what each one is for).

## Documentation

## What Muhammed-AbdelGhany/rest_api_mcp MCP server does

Muhammed-AbdelGhany/rest_api_mcp MCP server exposes authenticated REST API operations through MCP. It accepts a base API URL and login credentials, performs authentication as needed, and lets an agent call GET, POST, PUT, PATCH, and DELETE endpoints. The server can also retrieve an OpenAPI or Swagger document so an agent can understand available routes and request shapes.

Authentication is handled by the server rather than by agent-written login code. It can identify common token locations, retain the discovered token path for later logins, and retry authentication when a token has expired. Two-step login flows are supported when the API requires an OTP or another verification request.

## How it works

Configure the API base URL, email, and password as environment variables. When the agent calls `request`, the server logs in when necessary, adds the authorization header, and returns the HTTP status, status text, timing, login data, and API response. A short token cache helps avoid repeating login operations during rapid sequential calls.

For APIs with a Swagger or OpenAPI JSON endpoint, use `search_endpoints` to find routes by keywords across paths, summaries, descriptions, tags, and operation IDs. Use `describe_endpoint` to inspect one route’s parameters, body schema, enums, examples, and response schemas before making a request. `fetch_spec` returns the complete specification for broader inspection.

The `inspect_login` tool runs the login process, including optional 2FA verification, and exposes raw server responses instead of extracting a token. It also provides heuristic suggestions that can help determine the correct token location. Custom token paths and mappings for verification-session fields can be supplied to `request` when automatic detection does not match the API.

## Setup and configuration

The package can run through `npx` from an MCP configuration, or it can be cloned and built locally with npm. A basic configuration supplies `REST_BASE_URL`, `API_EMAIL`, and `API_PASSWORD`. `API_SWAGGER_URL` is strongly recommended when endpoint search, endpoint descriptions, full specification retrieval, or automatic login-endpoint discovery is needed.

Configuration is provided through environment variables, so changing authentication or API settings does not require source changes. The server also supports extra login fields supplied as JSON, including fields such as source, user role, channel, and device identifier. SSL verification can optionally be bypassed for development or staging systems using self-signed certificates, and response size limits can be configured to control context usage.

## Tools and capabilities

- `search_endpoints`: Finds likely routes and reports methods, paths, summaries, tags, and required parameters.
- `describe_endpoint`: Shows the OpenAPI details for one method and path, including a generated request-body example.
- `request`: Sends authenticated API calls, accepts extra headers and request bodies, and can skip authentication for public routes.
- `inspect_login`: Returns login and optional verification responses with token-detection suggestions.
- `fetch_spec`: Retrieves the complete OpenAPI or Swagger JSON document.

A practical workflow is to search first when the path is unknown, describe the selected endpoint when its body or response is unclear, and then call `request` with the required fields.

## Limitations and notes

The API must provide a login flow compatible with the server’s supported authentication handling, or the relevant token and verification fields must be configured through request options. Automatic token detection covers common response locations, but an unusual response shape may require `token_path`. Similarly, nonstandard 2FA session identifiers may require `verify_session_fields`.

Swagger-dependent discovery and schema features require a configured `API_SWAGGER_URL`. The server does not remove the need to understand the target API’s authorization rules, required values, or side effects. SSL bypass is intended for staging or development situations and should be evaluated carefully before use with production services.

_Full upstream README: https://allmcps.com/mcp/muhammed-abdelghany-rest-api-mcp/readme_