mcpo is a simple and secure MCP-to-OpenAPI proxy server, part of the open-webui project series. Its goal is to expose any MCP tool as an OpenAPI-compatible HTTP server.
[Purpose] MCP servers typically use raw stdio communication, which suffers from issues such as insufficient security, incompatibility with most tools, and a lack of standard features such as documentation, authentication, and error handling. mcpo is designed to solve these problems, allowing MCP tools to work with OpenAPI tools, SDKs, and UIs without additional work.
[Main capabilities]
- Proxy MCP server commands as standard RESTful OpenAPI services.
- Automatically generate interactive documentation for each tool, with no configuration required.
- HTTP-based, requiring no sockets or glue code.
- Support SSE and Streamable HTTP types of MCP servers, and provide custom request headers for SSE connections.
- Support hosting multiple MCP tools through a configuration file, with a configuration file format consistent with Claude Desktop, and each tool having its own route and OpenAPI schema.
- Support --hot-reload hot reloading, automatically monitoring configuration file changes and reloading the server without downtime.
- Support --root-path, allowing services to be provided under a reverse proxy or subpath.
- Support OAuth 2.1 authentication, using dynamic client registration by default, suitable for MCP servers that require authorization; on the first connection, it performs dynamic registration (if supported), opens browser authorization, automatically captures the callback, securely stores the token, and reuses the token in subsequent requests.
[Usage] The official recommendation is to use uv for a quick start and zero-configuration experience. Running via Python is also supported, or Docker can be used for installation-free operation. The basic usage is to run mcpo and specify the MCP server command. After startup, the MCP tools will appear in http://localhost:8000，并生成 OpenAPI schema, available at http://localhost:8000/docs Real-time testing. For SSE-compatible MCP servers, specify the server type and endpoint, and connection request headers may be provided. For Streamable HTTP-compatible MCP servers, likewise specify the type and endpoint. When using a subpath, use the --root-path parameter to make all routes served under the specified root path. When using a configuration file, multiple MCP tools can be served through a single config.json, each accessible under an independent route and each with its own OpenAPI schema and proxy handler; hot reload can be enabled via --hot-reload. In OAuth 2.1 configuration, server_url is the required OAuth server base URL, storage_type can be file (persistent) or memory (session-only), callback_port specifies the local callback port (default 3030), and use_loopback controls whether to automatically open the browser for authorization (default true). Advanced options can specify static client metadata for servers that do not support dynamic client registration. The documentation advises against setting scope, authorization_endpoint, or token_endpoint in the configuration, as these are automatically discovered during the dynamic registration flow. OAuth supports the streamable-http server type.
[Use cases] Scenarios where you want to quickly connect existing MCP tools to LLM agents, applications, or UIs that only support OpenAPI; scenarios where you need a safer, more stable, and more scalable tool service over HTTP; scenarios where you need to provide unified documentation and routing for multiple MCP tools; scenarios where you need to connect to MCP servers with OAuth authorization. When integrating with Open WebUI, refer to its official documentation.
[Limitations] OAuth only supports the streamable-http server type. Regarding runtime dependencies, uv is optional but recommended. Other limitation materials are not yet provided.
