mcpo
A simple, secure MCP-to-OpenAPI proxy server
Install / Use
claude mcp add open-webui -- npx -y github:open-webui/mcpoIf the server publishes to npm under a different name, use that package instead — check the repo README.
MCP Server
Model Context Protocol server
Quality Score
Category
Development & EngineeringSupported Platforms
Our assessment of mcpo
mcpo scores 83/100 on our quality scale, 3020th of 4,617 Development & Engineering skills we index.
Its MCP Server is 8.4 KB long, well organised into 12 sections with 13 code examples: a thorough specification that gives an agent plenty to work with.
With 4,417 GitHub stars, it is one of the more widely adopted skills in the catalogue.
Maintenance, license and trust
- The repository was last updated about 6 months ago. That is recent enough to be usable, but agent tooling moves fast, so check the instructions against your agent's current version.
- Our last check on 2026-10-21 found the source still online.
- It is released under the MIT license, a permissive license that allows use, modification and commercial use with attribution.
- Its trust signals score 93/100, with 1 caution from licensing, adoption, age or documentation. These come from repository metadata, not a code audit — read the skill file before letting an agent act on it.
Safety scan
No issues foundOur scan of the whole file found no instruction hijacking, hidden characters, credential access, data exfiltration or destructive commands. An AI review of the same text found nothing harmful.
AI review by kimi-k2.7-code on 2026-09-24. Automated pattern scan on 2026-09-24. It catches known dangerous patterns, not every risk — read a skill before letting an agent act on it.
mcpo compared with similar skills
All 4 of these similar skills score higher than mcpo; compare them before choosing.
| Skill | Score | Stars | Updated | Format |
|---|---|---|---|---|
| mcpo (this skill)by open-webui | 83 | 4.4k | 6mo ago | MCP Server |
| taste-skillby Leonxlnx | 100 | 110.6k | today | CLAUDE.md |
| Agent-Reachby Panniantong | 100 | 109.2k | today | CLAUDE.md |
| headroomby headroomlabs-ai | 100 | 78.9k | today | CLAUDE.md |
| ai-job-searchby ai-job-search-dev | 100 | 69.8k | today | CLAUDE.md |
Frequently asked questions
- How do I install mcpo?
- Run
claude mcp add open-webui -- npx -y github:open-webui/mcpo. The install tabs above show the steps for each supported agent. - Which AI agents does mcpo work with?
- It is written for Claude Code and Claude Desktop, as a MCP Server file. Other agents that read the same format can often use it too.
- Is mcpo safe to use?
- Our scan of the whole file found no instruction hijacking, hidden characters, credential access, data exfiltration or destructive commands. An AI review of the same text found nothing harmful. It is MIT-licensed and scores 93/100 on trust signals. Skills are instructions an agent will follow, so read the file before installing it and do not approve commands you do not understand.
- Is mcpo still maintained?
- The repository was last updated about 6 months ago. That is recent enough to be usable, but agent tooling moves fast, so check the instructions against your agent's current version.
Skill content
View source on GitHub⚡️ mcpo
Expose any MCP tool as an OpenAPI-compatible HTTP server—instantly.
mcpo is a dead-simple proxy that takes an MCP server command and makes it accessible via standard RESTful OpenAPI, so your tools "just work" with LLM agents and apps expecting OpenAPI servers.
No custom protocol. No glue code. No hassle.
🤔 Why Use mcpo Instead of Native MCP?
MCP servers usually speak over raw stdio, which is:
- 🔓 Inherently insecure
- ❌ Incompatible with most tools
- 🧩 Missing standard features like docs, auth, error handling, etc.
mcpo solves all of that—without extra effort:
- ✅ Works instantly with OpenAPI tools, SDKs, and UIs
- 🛡 Adds security, stability, and scalability using trusted web standards
- 🧠 Auto-generates interactive docs for every tool, no config needed
- 🔌 Uses pure HTTP—no sockets, no glue code, no surprises
What feels like "one more step" is really fewer steps with better outcomes.
mcpo makes your AI tools usable, secure, and interoperable—right now, with zero hassle.
🚀 Quick Usage
We recommend using uv for lightning-fast startup and zero config.
uvx mcpo --port 8000 --api-key "top-secret" -- your_mcp_server_command
Or, if you’re using Python:
pip install mcpo
mcpo --port 8000 --api-key "top-secret" -- your_mcp_server_command
To use an SSE-compatible MCP server, simply specify the server type and endpoint:
mcpo --port 8000 --api-key "top-secret" --server-type "sse" -- http://127.0.0.1:8001/sse
You can also provide headers for the SSE connection:
mcpo --port 8000 --api-key "top-secret" --server-type "sse" --header '{"Authorization": "Bearer token", "X-Custom-Header": "value"}' -- http://127.0.0.1:8001/sse
To use a Streamable HTTP-compatible MCP server, specify the server type and endpoint:
mcpo --port 8000 --api-key "top-secret" --server-type "streamable-http" -- http://127.0.0.1:8002/mcp
You can also run mcpo via Docker with no installation:
docker run -p 8000:8000 ghcr.io/open-webui/mcpo:main --api-key "top-secret" -- your_mcp_server_command
Example:
uvx mcpo --port 8000 --api-key "top-secret" -- uvx mcp-server-time --local-timezone=America/New_York
That’s it. Your MCP tool is now available at http://localhost:8000 with a generated OpenAPI schema — test it live at http://localhost:8000/docs.
🤝 To integrate with Open WebUI after launching the server, check our docs.
🌐 Serving Under a Subpath (--root-path)
If you need to serve mcpo behind a reverse proxy or under a subpath (e.g., /api/mcpo), use the --root-path argument:
mcpo --port 8000 --root-path "/api/mcpo" --api-key "top-secret" -- your_mcp_server_command
All routes will be served under the specified root path, e.g. http://localhost:8000/api/mcpo/memory.
🔄 Using a Config File
You can serve multiple MCP tools via a single config file that follows the Claude Desktop format.
Enable hot-reload mode with --hot-reload to automatically watch your config file for changes and reload servers without downtime:
Start via:
mcpo --config /path/to/config.json
Or with hot-reload enabled:
mcpo --config /path/to/config.json --hot-reload
Example config.json:
{
"mcpServers": {
"memory": {
"command": "npx",
"args": ["-y", "@modelcontextprotocol/server-memory"]
},
"time": {
"command": "uvx",
"args": ["mcp-server-time", "--local-timezone=America/New_York"],
"disabledTools": ["convert_time"] // Disable specific tools if needed
},
"mcp_sse": {
"type": "sse", // Explicitly define type
"url": "http://127.0.0.1:8001/sse",
"headers": {
"Authorization": "Bearer token",
"X-Custom-Header": "value"
}
},
"mcp_streamable_http": {
"type": "streamable-http",
"url": "http://127.0.0.1:8002/mcp"
} // Streamable HTTP MCP Server
}
}
Each tool will be accessible under its own unique route, e.g.:
- http://localhost:8000/memory
- http://localhost:8000/time
Each with a dedicated OpenAPI schema and proxy handler. Access full schema UI at: http://localhost:8000/<tool>/docs (e.g. /memory/docs, /time/docs)
🔐 OAuth 2.1 Authentication
mcpo supports OAuth 2.1 authentication for MCP servers that require it. The implementation defaults to dynamic client registration, so most servers only need minimal configuration:
{
"mcpServers": {
"oauth-protected-server": {
"type": "streamable-http",
"url": "http://localhost:8000/mcp",
"oauth": {
"server_url": "http://localhost:8000"
}
}
}
}
OAuth Configuration Options
Basic Options:
server_url(required): OAuth server base URLstorage_type: "file" (persistent) or "memory" (session-only, default: "file")callback_port: Local port for OAuth callback (default: 3030)use_loopback: Auto-open browser for auth (default: true)
Advanced Options (rarely needed): For servers that don't support dynamic client registration, you can specify static client metadata:
{
"mcpServers": {
"legacy-oauth-server": {
"type": "streamable-http",
"url": "http://api.example.com/mcp",
"oauth": {
"server_url": "http://api.example.com",
"client_metadata": {
"client_name": "My MCPO Client",
"redirect_uris": ["http://localhost:3030/callback"]
}
}
}
}
}
Note: Avoid setting
scope,authorization_endpoint, ortoken_endpointin the config. These are automatically discovered from the server's OAuth metadata during the dynamic registration flow.
On first connection, mcpo will:
- Perform dynamic client registration (if supported)
- Open your browser for authorization
- Capture the OAuth callback automatically
- Store tokens securely (in
~/.mcpo/tokens/for file storage) - Use tokens for all subsequent requests
OAuth is supported for streamable-http server types. See OAUTH_GUIDE.md for detailed documentation.
🔧 Requirements
- Python 3.8+
- uv (optional, but highly recommended for performance + packaging)
🛠️ Development & Testing
To contribute or run tests locally:
-
Set up the environment:
# Clone the repository git clone https://github.com/open-webui/mcpo.git cd mcpo # Install dependencies (including dev dependencies) uv sync --dev -
Run tests:
uv run pytest -
Running Locally with Active Changes:
To run
mcpowith your local modifications from a specific branch (e.g.,my-feature-branch):# Ensure you are on your development branch git checkout my-feature-branch # Make your code changes in the src/mcpo directory or elsewhere # Run mcpo using uv, which will use your local, modified code # This command starts mcpo on port 8000 and proxies your_mcp_server_command uv run mcpo --port 8000 -- your_mcp_server_command # Example with a test MCP server (like mcp-server-time): # uv run mcpo --port 8000 -- uvx mcp-server-time --local-timezone=America/New_YorkThis allows you to test your changes interactively before committing or creating a pull request. Access your locally running
mcpoinstance athttp://localhost:8000and the auto-generated docs athttp://localhost:8000/docs.
🪪 License
MIT
🤝 Contributing
We welcome and strongly encourage contributions from the community!
Whether you're fixing a bug, adding features, improving documentation, or just sharing ideas—your input is incredibly valuable and helps make mcpo better for everyone.
Getting started is easy:
- Fork the repo
- Create a new branch
- Make your changes
- Open a pull request
Not sure where to start? Feel free to open an issue or ask a question—we’re happy to help you find a good first task.
✨ Star History
<a href="https://star-history.com/#open-webui/mcpo&Date"> <picture> <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/svg?repos=open-webui/mcpo&type=Date&theme=dark" /> <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/svg?repos=open-webui/mcpo&type=Date" /> <img alt="Star History Chart" src="https://api.star-history.com/svg?repos=open-webui/mcpo&type=Date" /> </picture> </a>✨ Let's build the future of interoperable AI tooling together!
Related Skills
taste-skill
110.6kAgent skills that give coding agents taste: art direction, reference images and a browser check instead of generic AI pages
Agent-Reach
109.2kGive your AI agent eyes to see the entire internet. Read & search Twitter, Reddit, YouTube, GitHub, Bilibili, XiaoHongShu — one CLI, zero API fees.
headroom
78.9kCompress tool outputs, logs, files, and RAG chunks before they reach the LLM. 20% fewer tokens for coding agents, 60-95% fewer tokens for JSON, same answers. Library, proxy, MCP server.
ai-job-search
69.8kThe job search that runs on your machine. AI job application framework built on Claude Code: evaluate postings, tailor CVs, write cover letters, prep interviews. Fork it and own it.
Languages
Trust signals
From repository metadata: license, adoption, age and documentation. Not a code audit — see the Safety scan above for what the skill file itself contains.
