Rest API MCP

What Muhammed-AbdelGhany/rest_api_mcp MCP server does

Muhammed-AbdelGhany/rest_api_mcp MCP server exposes authenticated REST API operations through MCP. It accepts a base API URL and login credentials, performs authentication as needed, and lets an agent call GET, POST, PUT, PATCH, and DELETE endpoints. The server can also retrieve an OpenAPI or Swagger document so an agent can understand available routes and request shapes.

Authentication is handled by the server rather than by agent-written login code. It can identify common token locations, retain the discovered token path for later logins, and retry authentication when a token has expired. Two-step login flows are supported when the API requires an OTP or another verification request.

How it works

Configure the API base URL, email, and password as environment variables. When the agent calls request, the server logs in when necessary, adds the authorization header, and returns the HTTP status, status text, timing, login data, and API response. A short token cache helps avoid repeating login operations during rapid sequential calls.

For APIs with a Swagger or OpenAPI JSON endpoint, use search_endpoints to find routes by keywords across paths, summaries, descriptions, tags, and operation IDs. Use describe_endpoint to inspect one route’s parameters, body schema, enums, examples, and response schemas before making a request. fetch_spec returns the complete specification for broader inspection.

The inspect_login tool runs the login process, including optional 2FA verification, and exposes raw server responses instead of extracting a token. It also provides heuristic suggestions that can help determine the correct token location. Custom token paths and mappings for verification-session fields can be supplied to request when automatic detection does not match the API.

Setup and configuration

The package can run through npx from an MCP configuration, or it can be cloned and built locally with npm. A basic configuration supplies REST_BASE_URL, API_EMAIL, and API_PASSWORD. API_SWAGGER_URL is strongly recommended when endpoint search, endpoint descriptions, full specification retrieval, or automatic login-endpoint discovery is needed.

Configuration is provided through environment variables, so changing authentication or API settings does not require source changes. The server also supports extra login fields supplied as JSON, including fields such as source, user role, channel, and device identifier. SSL verification can optionally be bypassed for development or staging systems using self-signed certificates, and response size limits can be configured to control context usage.

Tools and capabilities

• search_endpoints: Finds likely routes and reports methods, paths, summaries, tags, and required parameters.
• describe_endpoint: Shows the OpenAPI details for one method and path, including a generated request-body example.
• request: Sends authenticated API calls, accepts extra headers and request bodies, and can skip authentication for public routes.
• inspect_login: Returns login and optional verification responses with token-detection suggestions.
• fetch_spec: Retrieves the complete OpenAPI or Swagger JSON document.

A practical workflow is to search first when the path is unknown, describe the selected endpoint when its body or response is unclear, and then call request with the required fields.

Limitations and notes

The API must provide a login flow compatible with the server’s supported authentication handling, or the relevant token and verification fields must be configured through request options. Automatic token detection covers common response locations, but an unusual response shape may require token_path. Similarly, nonstandard 2FA session identifiers may require verify_session_fields.

Swagger-dependent discovery and schema features require a configured API_SWAGGER_URL. The server does not remove the need to understand the target API’s authorization rules, required values, or side effects. SSL bypass is intended for staging or development situations and should be evaluated carefully before use with production services.