MCPForge - turn reviewed API's into trusted MCP integrations

MCP Forge discovers backend API contracts, proposes safe agent scopes, generates FastMCP tools, verifies them, and packages a secret-free Codex integration plugin.

Comment

Inspiration

APIs contain powerful capabilities, but connecting them to AI agents usually requires manual tool definitions, permission mapping, testing, and deployment work. We built MCP Forge to make that process safer and more repeatable - turning reviewed API contracts into trusted MCP integrations while keeping humans in control of scope and changes.

What it does

MCP Forge:

  • Discovers OpenAPI, Postman, and API route evidence
  • Proposes safe, agent-ready capability scopes
  • Generates typed Python FastMCP tools
  • Verifies generated tools in Docker
  • Uses GPT-5.6 to propose bounded repairs from sanitized failure evidence
  • Requires human approval before applying repairs
  • Packages verified tools as a secret-free Codex integration plugin

How we built it

We built MCP Forge with Codex and GPT-5.6 using TypeScript, Node.js, React/Vite, Docker, Python FastMCP, and the Model Context Protocol SDK. The system includes a CLI, web UI, reusable FastMCP skill, Builder plugin, verification runner, repair workflow, security checks, and packaging pipeline. OpenAPI and Postman contracts are normalized into a canonical API model before scope decisions and tool generation.

Challenges we ran into

The hardest challenge was avoiding unsafe automation. Generating a wrapper is easy; deciding what an agent should be allowed to do requires context, confidence, and review. We also had to handle undocumented routes, mutations, authentication boundaries, generated-code failures, secret redaction, reproducible verification, and safe LLM-generated patches without allowing uncontrolled changes.

Accomplishments that we're proud of

We created an end-to-end workflow that goes from API contract to verified MCP integration. We are especially proud that:

  • Mutating or ambiguous operations require explicit approval
  • Verification runs in Docker with reproducible evidence
  • GPT-5.6 repairs are bounded, validated, and human-approved
  • Released packages contain no credentials
  • Judges can run a no-secret demo using the included fixtures
  • The Builder plugin makes the workflow reusable across repositories

What we learned

We learned that trustworthy agent integrations need more than schemas and generated code. They need capability scoping, provenance, verification, auditability, and clear human control points. We also learned that LLMs are most useful in this workflow when they propose small, reviewable changes rather than silently modifying production behavior.

What's next for MCPForge - turn reviewed API's into trusted MCP integrations

Next, we plan to expand authentication support, improve contract discovery for larger repositories, add richer policy controls, support more deployment targets, and strengthen observability and audit workflows. Our long-term goal is for MCP Forge to become a trusted control plane for converting reviewed API capabilities into secure, verified, and shareable MCP integrations.

Share this project:

Updates