Spec2Agent

Instantly compile any OpenAPI/Swagger spec into a secure AI agent via the Model Context Protocol (MCP).

Giving an LLM access to your production APIs is traditionally a terrifying, boilerplate-heavy nightmare. Developers waste hundreds of hours manually translating API endpoints into rigid LLM tool schemas, and CTOs lose sleep over AI agents accidentally executing mutating database queries.

Spec2Agent solves this. It acts as an intelligent middleware proxy that takes your existing OpenAPI/Swagger specs and automatically generates a highly secure, rate-limited MCP (Model Context Protocol) Server.

Key Features

• Zero-Boilerplate Ingestion: Point Spec2Agent at a swagger.json or openapi.yaml file, and it instantly generates type-safe LLM tools for every endpoint.
• Human-in-the-Loop (HITL) Gateway: By default, read-only (GET) requests pass through freely. Mutating requests (POST, PUT, DELETE) are paused and routed to a Slack/Web dashboard for human approval before execution.
• Smart execution Proxy: Spec2Agent doesn't just generate code; it runs a reverse proxy to handle authentication safely, meaning the LLM never sees your raw API keys.
• Native MCP Support: Integrates seamlessly with Claude Desktop, Cursor, or any custom LLM architecture using Anthropic's Model Context Protocol standard.

How it Works (The Architecture)

1. Ingest: Parses your OpenAPI 3.0+ specs into an Abstract Syntax Tree (AST).
2. Translate: Converts endpoints into strongly-typed MCP Tool Definitions.
3. Serve: Spins up a secure Node.js execution proxy.
4. Protect: Routes execution requests through a Role-Based Access Control (RBAC) and Approval Queue.

Quick Start (Coming Soon)

Note: Spec2Agent is currently in active development. Below is the target usage API.

# 1. Install globally
npm install -g spec2agent

# 2. Point it at your API spec
spec2agent compile https://api.yourcompany.com/swagger.json

# 3. Start the secure MCP server
spec2agent start --port 3000 --require-approval true

Once running, your AI client can immediately execute complex, multi-step queries against your infrastructure safely in plain English:

Fetch the top 5 highest-paying customers from last month and pause their active subscription billing. [Action paused: Awaiting Admin Approval]

Roadmap

• [x] Core Architecture Design
• [ ] OpenAPI 3.0 parsing engine
• [ ] MCP Server integration & Tool generation
• [ ] Reverse Proxy with secure header/auth injection
• [ ] SQLite/Redis backed Human-in-the-loop approval queue
• [ ] Docker packaging & CI/CD deployment workflows

Contributing

PRs and architecture discussions are welcome. This is an open-source project aimed at standardizing secure Enterprise LLMOps.

License

MIT License