mcpo MCP OpenAPI Proxy

Source-backed facts for citing this resource, derived directly from the registry — also available as plain text for AI assistants.

Canonical URL

https://heyclau.de/entry/mcp/mcpo-mcp-openapi-proxy

Source URLs

https://github.com/open-webui/mcpo/blob/main/README.md, https://github.com/open-webui/mcpo

Brand

mcpo

Brand domain

github.com

Safety notes

mcpo exposes proxied MCP tools as HTTP endpoints, so every tool permission from the wrapped MCP server becomes reachable through the OpenAPI surface., Use a strong API key and avoid publishing the server to untrusted networks without authentication, TLS, and network controls., Proxied tools may read, write, delete, send, deploy, or execute depending on the wrapped MCP server., Config-file and hot-reload mode can add or change proxied servers while mcpo is running., OAuth and custom header support can store or forward access tokens, bearer tokens, and service credentials.

Privacy notes

Tool names, OpenAPI schemas, prompts, arguments, tool outputs, proxied server URLs, headers, API keys, OAuth tokens, logs, and generated docs may be visible to mcpo, connected clients, and model providers., OpenAPI docs can reveal the available tool surface and parameter shapes for sensitive MCP servers., Store config files and OAuth token storage in locations with appropriate filesystem permissions., Avoid proxying private MCP tools into shared OpenAPI workspaces unless all downstream users are authorized for the underlying tools.

Author

open-webui

Submitted by

oktofeesh1

Claim status

unclaimed

Last verified

2026-06-05

• Tool names, OpenAPI schemas, prompts, arguments, tool outputs, proxied server URLs, headers, API keys, OAuth tokens, logs, and generated docs may be visible to mcpo, connected clients, and model providers.
• OpenAPI docs can reveal the available tool surface and parameter shapes for sensitive MCP servers.
• Store config files and OAuth token storage in locations with appropriate filesystem permissions.
• Avoid proxying private MCP tools into shared OpenAPI workspaces unless all downstream users are authorized for the underlying tools.

• Python 3.11 or newer, with uv recommended by the upstream project.
• An MCP server command, SSE endpoint, or Streamable HTTP endpoint you are authorized to proxy.
• API key or other access control planned before exposing the HTTP server beyond local testing.
• Network binding, reverse proxy, root path, and TLS settings reviewed before deployment.
• OAuth storage, headers, and config-file hot reload reviewed when proxying remote or authenticated MCP servers.

Show that mcpo MCP OpenAPI Proxy is listed on HeyClaude. Paste this Markdown into your README — it renders the badge and links back to this page.

[![Listed on HeyClaude](https://heyclau.de/badge/mcp/mcpo-mcp-openapi-proxy.svg)](https://heyclau.de/entry/mcp/mcpo-mcp-openapi-proxy)

mcpo MCP OpenAPI Proxy side by side with 3 alternatives on trust, install, platform support, and disclosed safety notes — all from reviewed registry metadata.

Field	mcpo MCP OpenAPI Proxy MCP-to-OpenAPI proxy server that wraps MCP servers and exposes their tools as standard HTTP endpoints with generated OpenAPI schemas and docs. Open dossier	Agentgateway MCP Gateway Apache-2.0 agentic proxy that can expose stdio, HTTP, SSE, and Streamable HTTP MCP servers through a managed gateway with federation, OAuth/JWT authentication, RBAC/CEL policy, CORS, TLS, observability, and Kubernetes Gateway API support. Open dossier	tbxark MCP Proxy Server MIT-licensed MCP proxy server that aggregates multiple downstream MCP servers behind one HTTP service, exposing each configured server through SSE or Streamable HTTP endpoints with auth tokens and tool filtering. Open dossier	Unla MCP Gateway Lightweight Go MCP gateway that turns existing MCP servers and REST APIs into managed SSE or Streamable HTTP MCP endpoints through configuration. Open dossier
Next steps	Open dossierCopy installCopy configAPI JSONOpen LLMMCP feedOpen sourceNewsletterClaim listing	Open dossierCopy installCopy configAPI JSONOpen LLMMCP feedOpen sourceNewsletterClaim listing	Open dossierCopy installCopy configAPI JSONOpen LLMMCP feedOpen sourceNewsletterClaim listing	Open dossierCopy installCopy configAPI JSONOpen LLMMCP feedOpen sourceNewsletterClaim listing
Trust	Review first	Review first	Review first	Review first
Review status	Not reviewed	Not reviewed	Not reviewed	Not reviewed
Package trust	Package not verified	Package not verified	Package not verified	Package not verified
Source provenance	Source-backed	Source-backed	Source-backed	Source-backed
Submitter	oktofeesh1	oktofeesh1	oktofeesh1	oktofeesh1
Install risk	Review first	Review first	Review first	Review first
Notes	Safety ✓ Privacy ✓	Safety ✓ Privacy ✓	Safety ✓ Privacy ✓	Safety ✓ Privacy ✓
Brand	—	agentgateway	—	Unla
Category	mcp	mcp	mcp	mcp
Source	Source-backed	Source-backed	Source-backed	Source-backed
Author	open-webui	agentgateway	tbxark	AmoyLab
Added	2026-06-05	2026-06-06	2026-06-06	2026-06-05
Platforms	Claude CodeCodexCursorClaude Desktop	Claude CodeClaude Desktop	Claude CodeClaude Desktop	Claude CodeClaude Desktop
Harness	Claude CodeCodexCursorClaude Desktop	Claude CodeClaude Desktop	Claude CodeClaude Desktop	Claude CodeClaude Desktop
Source repo	—	—	—	—
Safety notes	✓mcpo exposes proxied MCP tools as HTTP endpoints, so every tool permission from the wrapped MCP server becomes reachable through the OpenAPI surface. Use a strong API key and avoid publishing the server to untrusted networks without authentication, TLS, and network controls. Proxied tools may read, write, delete, send, deploy, or execute depending on the wrapped MCP server. Config-file and hot-reload mode can add or change proxied servers while mcpo is running. OAuth and custom header support can store or forward access tokens, bearer tokens, and service credentials.	✓Agentgateway can aggregate and expose many downstream MCP targets through one endpoint; every target's permissions become part of the gateway surface. Stdio targets are spawned by the gateway process, so commands such as package runners or containers inherit the gateway host's trust boundary. Demo configs use permissive CORS and local authorization servers; lock down origins, headers, issuers, audiences, JWKS, and resource metadata before production use. CEL/RBAC policies can inspect MCP tool names, arguments, results, prompts, resources, request bodies, JWT claims, API keys, and backend metadata; test policies before relying on them. Remote MCP proxying, OAuth provider adaptation, Kubernetes routing, TLS termination, and guardrails are infrastructure changes that should go through normal security review.	✓tbxark MCP Proxy Server can spawn stdio subprocess MCP servers and connect to remote SSE or Streamable HTTP MCP endpoints. Every exposed route inherits the permissions of its downstream server; use per-server `authTokens` and tool filters instead of exposing all tools broadly. The docs support remote config URLs and an `--insecure` TLS flag; avoid untrusted configs and do not disable TLS verification outside controlled testing. Token-in-route fallback can expose credentials through browser history, proxy logs, metrics, and referrers; prefer authorization headers when clients support them. Logging can be enabled globally or per server, so review logs before routing secrets, prompts, tool arguments, or tool outputs.	✓Unla can expose existing MCP servers and REST APIs as new MCP endpoints, so the final tool surface depends on every imported config. Generated endpoints may proxy read/write API operations; review tool descriptions and permissions before connecting an autonomous agent. The upstream README notes that Unla is under rapid development and that documentation can lag behind implementation. Replace default admin credentials and secrets before exposing the management UI or gateway outside a trusted development network. Hot-loaded gateway configuration, multi-tenant routing, OAuth pre-authentication, and management UI access should be governed like production API infrastructure.
Privacy notes	✓Tool names, OpenAPI schemas, prompts, arguments, tool outputs, proxied server URLs, headers, API keys, OAuth tokens, logs, and generated docs may be visible to mcpo, connected clients, and model providers. OpenAPI docs can reveal the available tool surface and parameter shapes for sensitive MCP servers. Store config files and OAuth token storage in locations with appropriate filesystem permissions. Avoid proxying private MCP tools into shared OpenAPI workspaces unless all downstream users are authorized for the underlying tools.	✓MCP requests, tool arguments, tool results, prompt names, resource names, session IDs, JWT/API-key claims, raw request/response bodies, logs, traces, and telemetry may pass through the gateway. CEL policy and observability features may buffer or inspect request and response bodies depending on configuration. OAuth/JWT metadata, bearer tokens, API keys, DCR secrets, Keycloak/Auth0/Okta settings, and upstream MCP credentials must be protected as secrets. Any data returned by downstream MCP tools can still be sent onward by the MCP client to the configured model provider.	✓The proxy may process downstream server commands, environment variables, headers, auth tokens, remote config URLs, tool names, tool arguments, tool outputs, prompts, resources, logs, and route keys. Stdio subprocesses inherit configured environment variables and can access whatever local paths, network services, or credentials those commands can reach. Remote config files can reveal internal MCP server names, endpoint URLs, auth headers, tool filters, and secret placeholders. Keep config files, tokens, `.env` values, logs, and Docker volume mounts out of public repositories and shared support output.	✓Unla may receive prompts, tool names, tool arguments, REST API parameters, upstream MCP responses, generated endpoint metadata, logs, admin credentials, JWT secrets, OAuth tokens, and configuration history. Imported REST API and MCP server configs can include private upstream URLs, headers, tokens, tenant identifiers, and service credentials. Persisted config backends and container logs may retain sensitive endpoint definitions and operational metadata. Do not commit real gateway configs, API credentials, admin passwords, JWT secrets, OAuth client secrets, or exported tenant data.
Prerequisites	Python 3.11 or newer, with uv recommended by the upstream project. An MCP server command, SSE endpoint, or Streamable HTTP endpoint you are authorized to proxy. API key or other access control planned before exposing the HTTP server beyond local testing. Network binding, reverse proxy, root path, and TLS settings reviewed before deployment.	Agentgateway binary, container image, or source checkout from the upstream release/container/docs path. At least one downstream MCP target, such as a stdio command, remote MCP server, SSE server, or Streamable HTTP server. MCP client that can connect to the exposed Streamable HTTP or SSE route. Auth, CORS, TLS, route, and policy configuration reviewed before shared or remote exposure.	Go toolchain for source install, or Docker for the GHCR image deployment path. A v2 JSON configuration file defining `mcpProxy` and downstream `mcpServers`. Downstream MCP server commands, URLs, headers, environment variables, and secrets prepared before proxy startup. Public base URL, bind address, route type, auth token policy, logging policy, and tool filters reviewed before exposing the proxy beyond localhost.	Docker available for the all-in-one deployment, or Kubernetes and Helm if using the packaged cluster deployment. Administrator username, administrator password, and JWT secret replaced before first start. At least one existing MCP server or REST API configuration ready to import into the gateway. Network, TLS, reverse proxy, and port exposure reviewed before sharing generated MCP endpoints.
Install	uvx mcpo --port 8000 --api-key YOUR_API_KEY -- YOUR_MCP_SERVER_COMMAND Copy install	docker pull ghcr.io/agentgateway/agentgateway Copy install	go install github.com/tbxark/mcp-proxy@latest Copy install	docker run --name unla -p 8080:80 -p 5235:5235 -e ENV=production -e APISERVER_JWT_SECRET_KEY=YOUR_RANDOM_SECRET -e SUPER_ADMIN_USERNAME=YOUR_ADMIN_USER -e SUPER_ADMIN_PASSWORD=YOUR_ADMIN_PASSWORD ghcr.io/amoylab/unla/allinone:latest Copy install
Config	{ "mcpServers": { "example": { "command": "uvx", "args": ["mcp-server-time", "--local-timezone=America/New_York"] } } } Copy config	{ "mcpServers": { "agentgateway": { "url": "LOCAL_AGENTGATEWAY_MCP_URL", "headers": { "Authorization": "Bearer AGENTGATEWAY_MCP_TOKEN" } } } } Copy config	{ "mcpProxy": { "baseURL": "MCP_PROXY_BASE_URL", "addr": ":9090", "name": "MCP Proxy", "version": "1.0.0", "type": "streamable-http", "options": { "authTokens": [ "REPLACE_WITH_PROXY_TOKEN" ] } }, "mcpServers": { "fetch": { "command": "uvx", "args": [ "mcp-server-fetch" ], "options": { "toolFilter": { "mode": "allow", "list": [ "fetch" ] } } } } } Copy config	{ "mcpServers": { "unla-sse": { "url": "UNLA_SSE_ENDPOINT" } } } Copy config
Citations	Source repositorygithub.com 2026-07-21T07:17:01+00:00 Documentationgithub.com Submitted by oktofeesh12026-06-05 Source methodology →	Source repositorygithub.com 2026-07-21T07:17:01+00:00 Documentationagentgateway.dev Submitted by oktofeesh12026-06-06 Source methodology →	Source repositorygithub.com 2026-07-21T07:17:01+00:00 Documentationgithub.com Submitted by oktofeesh12026-06-06 Source methodology →	Source repositorygithub.com 2026-07-21T07:17:01+00:00 Documentationdocs.unla.amoylab.com Submitted by oktofeesh12026-06-05 Source methodology →
Claim	Unclaimed	Unclaimed	Unclaimed	Unclaimed

Source-backed guides for putting this to work.