Generate and host MCP tools from OpenAPI.

Use the existing Build dashboard or local CLI. No separate gateway service is required.

Preview, download, deploy

Owners with Business Build access can open Build / OpenAPI to MCP. Upload JSON, paste a document, or supply a public HTTPS specification URL. Preview saves a draft without making upstream API calls. Download either JSON tool schemas or a standalone TypeScript stdio server package. The package runs on Node 22.19+ without dependency installation and uses environment credentials; saved upstream secrets are never exported. tools.ts names the argument type for each selected tool. The server still executes from server.ts and config.json.

Private GitHub repository

After tools are generated, an Owner can create a new private GitHub repository from the same page. This publishes the same files as the executable server download. It does not deploy the server, run Checks, or open a pull request.

1. Generate the MCP tools. The repository form appears only after that preview exists.
2. In GitHub, create a personal access token that can create a private repository and commit to it. A classic token needs the repo scope. Knotbind uses the token for this request only and does not store it. Revoke it after the repository is created.
3. Enter the token. The repository name starts as mcp-server- plus the service name. Leave Organization blank to create the repository under the token's user. Enter an organization login only when that token is allowed to create repositories there.
4. Submit Create private GitHub repo. Knotbind creates the private repository, then commits package.json, server.ts, tools.ts, config.json, USAGE.txt, and the runtime files in one commit. tools.ts is the typed argument list for the selected operations. server.ts is still the executable entry.

A name that already exists is left unchanged. If the repository is created but the commit fails, Knotbind keeps the repository URL and does not mark the source delivered. Success records that URL and marks source delivered. Staging, Checks, and the rest of the acceptance checklist stay unchanged. Deploy and monitor the server separately.

Tool names use snake_case. Select names with a comma-separated filter. Read-only operations are selected by default; exposing write tools requires explicit opt-in. Calls to write tools may mutate real data and are never automatically retried.

Hosted endpoint

Set a public HTTPS API base URL and optional Bearer, API key header, Basic or OAuth client-credentials configuration. OAuth requires an explicit token URL, client ID, client secret and optional scopes. Credentials are encrypted at rest; access tokens are exchanged for each call and never persisted. Confirm deployment to replace the workspace relay target and revoke its previous URL. Copy the private URL shown once, then add it to your MCP client. Stop and revoke the endpoint from the same page.

The hosted relay supports initialize, tools/list, tools/call, ping, and initialized notifications. Existing monitoring configurations are preserved separately. Confirm a Sandbox target at deployment to enroll read-only tools that accept empty arguments, subject to the shared workspace Check limit. Checks run now and on the existing account watch; the first successful response captures each Check's independent Baseline. Writes and tools needing explicit arguments are skipped.

Scoped execution grants

Create an agent API key with tool:execute on the API access page. The Owner can authorize exact deployed tool names for 15 to 60 minutes. The scoped relay URL must be used with that same API key in Authorization. Writes require both explicit Owner approval and tool:execute:write. That grant is not the per-call pause below. Revoking the key or grant, expiry, stopping or redeploying invalidates access. POST /api/v1/credential-grants/{id}/token rotates an approved agent's token without extending its deadline or exposing an upstream credential. This is API-key-bound delegation, not verification of an assistant's self-reported clientInfo.

Approve one write call

A hosted relay write does not run until the Owner approves that exact call. Read-only tools are not paused. The upstream API is not called while the call is waiting. A downloaded package does not have this pause: the process that runs it owns the call.

1. Call tools/call on the hosted relay URL with the write tool and the arguments to run.
2. Knotbind answers HTTP 403 and JSON-RPC -32001. The message says the write is waiting for Owner approval. The error data carries approvalId, a one-time approvalToken, and expiresAt. Keep the token. Knotbind stores only its hash.
3. Open Build / OpenAPI to MCP as the Owner. Under "Write tool calls waiting for one-time approval", choose Approve this call once for that tool. The approval lasts 15 minutes from the paused call, not from the click.
4. Retry the same tools/call with the same tool and the same arguments. Send the token in the X-Knotbind-Tool-Approval header. Knotbind then calls the upstream API once.

curl -X POST "$RELAY_URL" -H "Content-Type: application/json" -d '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"create_item","arguments":{"title":"Lamp"}}}'

curl -X POST "$RELAY_URL" -H "Content-Type: application/json" -H "X-Knotbind-Tool-Approval: $APPROVAL_TOKEN" -d '{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"create_item","arguments":{"title":"Lamp"}}}'

A second use of the token, a changed argument, another tool, or an expired approval does not match. Retrying without a match pauses a new call and returns a new token. At most 20 unused approvals are kept. Arguments larger than 16 KB are refused before a token is issued.

What a tool call cannot send

These checks run before the upstream request, on the hosted relay and on a generated server. A failed check throws. It does not become an upstream call.

The credential belongs in the hosted authentication configuration or in KNOTBIND_UPSTREAM_CREDENTIAL on a downloaded server, not in tool arguments. If an upstream error echoes that credential, Knotbind replaces the known value with [REDACTED] before returning the body.

Local CLI

node bin/knotbind.mjs openapi-to-mcp ./openapi.json --ops list_users,get_user --max 100
node bin/knotbind.mjs openapi-to-mcp https://api.example.com/openapi.json

No API key is needed for local conversion. Use - as the input for stdin. --max bounds top-level array responses, not the operation count. Use --format package --out server.tar.gz for a runnable package; writes require --allow-write. Extract and run npm start. Set KNOTBIND_API_BASE_URL to override the API base and KNOTBIND_UPSTREAM_CREDENTIAL for configured authentication. OAuth exports accept a caller-supplied short-lived Bearer token, never the hosted client secret.

Supported scope and limits

Standalone HTTP transport

The exported package also supports stateless Streamable HTTP: set KNOTBIND_MCP_TRANSPORT=http, optional KNOTBIND_MCP_PORT (default 3000), and a separate random KNOTBIND_MCP_TOKEN with 32+ printable non-space characters. It binds only to 127.0.0.1 at /mcp. POST requests require that Bearer token, JSON content type and Accept for both application/json and text/event-stream. Responses are JSON; notifications return 202. GET/DELETE return 405 because no server stream or sessions are provided. HTTP requests are capped at 1 MB, 60/minute and four concurrent requests per process. Remote hosting needs an explicitly secured TLS reverse proxy; untrusted Host/Origin values are rejected, and cross-origin browser access is not supported. The inbound MCP token is never the upstream credential. This is local transport verification, not real-assistant acceptance or a production hosting certificate.

Owners can supply explicit validated read-only Sandbox fixtures, inspect account-scoped current/prior Run history and enable failure/recovery alerts. Review spec update regenerates a draft from supplied JSON without changing the live endpoint, adding unselected tools or publishing a repository PR. The separate credential vault supports OAuth-client/member operation consent.

Scheduled contract review

Remote contract watch tracks one public HTTPS JSON source on the existing durable Account schedule, at an Owner-selected 1-168 hour interval. Polls are bounded to 500 KB/ten seconds, send no upstream auth and follow no redirects. Changes create a separate review record; no operation, deployment, credential grant or Baseline is changed. New operations remain unselected, read-to-write transitions block staging, and an unrelated Owner draft cannot be overwritten. Dismissal is scoped to source/baseline fingerprints; downgrade pauses fetching. Manual checks are capped at six/hour. JSONB key ordering does not create false drift.

Repository dry-run bundle

Owners can stage a current safe review as a draft or download selected contract/tools plus SHA-256 file hashes and proposed repository branch/PR metadata. Paths must be relative JSON files under contracts/; GitHub/GitLab URLs and refs are validated. Blocked reviews contain metadata only. This adapter never writes files, calls a repository, creates a branch, commits or publishes a PR. Sandbox verification and actual publication require separate explicit authorization. Conversion uses bounded schema expansion and a 2 MB normalized tool limit; review file contents are capped at 5 MB. Treat schema/descriptions as confidential even though saved upstream auth is excluded.