# Mcp Forge

> 🔨 Forge any API into a tested, secure, monetizable, deployable MCP server — one CLI. Turn any OpenAPI/Swagger spec into an MCP server AI agents (Claude, ChatGPT, Cursor) can use.

- **Type:** MCP server
- **Install:** `agentstack add mcp-muhammad-adil-code-mcp-forge`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [Muhammad-Adil-code](https://agentstack.voostack.com/s/muhammad-adil-code)
- **Installs:** 0
- **Category:** [AI & ML](https://agentstack.voostack.com/c/ai-and-ml)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [Muhammad-Adil-code](https://github.com/Muhammad-Adil-code)
- **Source:** https://github.com/Muhammad-Adil-code/Mcp-forge
- **Website:** https://www.npmjs.com/package/@muhammad-adil-code/mcp-forge

## Install

```sh
agentstack add mcp-muhammad-adil-code-mcp-forge
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

**One command from any API to a tested, secure, deployable MCP server.**

[](https://www.npmjs.com/package/@muhammad-adil-code/mcp-forge)
[](./LICENSE)
[](https://nodejs.org)
[](https://modelcontextprotocol.io)

---

## Why MCPForge

AI agents (ChatGPT, Claude, Cursor, and custom ones) are shifting from **talking** to
**doing** — they act across your apps for you. For an agent to *use* an app, that app
needs an **MCP server** (Model Context Protocol) — a universal "socket" any agent can
plug into.

Soon every product will be asked *"does this work with my AI agent?"* — the way
*"do you have a mobile app?"* became mandatory a decade ago. But building an MCP server
today means stitching together **five different tools**: one to convert your API, one
to test it, one to scan it for security, one to run it, one to monetize it.

**MCPForge is the one tool that does the whole job** — the neutral developer experience
that runs the full lifecycle on top of the open standard.

```bash
npx mcp-forge init      ./openapi.json   #  inspect: tools, auth, a security glance
npx mcp-forge scan      ./openapi.json   #  low-noise security scan (CI-friendly)
npx mcp-forge test      ./openapi.json   #  call every tool live + report what works
npx mcp-forge monetize  ./openapi.json   #  emit a usage meter + pricing you own
npx mcp-forge generate  ./openapi.json   #  emit a deployable MCP server you own
npx mcp-forge serve     ./openapi.json   #  run it locally + watch every agent call
```

## Universal by design

- **Any API in** — any OpenAPI 2 (Swagger) or 3.x spec, JSON or YAML, file or URL. The
  API can be written in **any** language or framework (Node, Python, Go, Rails, PHP…).
  MCPForge only reads the spec.
- **Any agent out** — it emits a standard MCP server, so it works with **any** MCP client.
- **No lock-in** — `generate` writes files **you own** and can deploy anywhere.

## Install

```bash
npm install -g @muhammad-adil-code/mcp-forge
# …or run without installing:
npx @muhammad-adil-code/mcp-forge  
```

> After a global install, the `mcpforge` command is available directly.

## Commands

| Command | What it does |
|---|---|
| `init` / `inspect` | Parse the spec → show the tools, declared auth, and a quick security glance. |
| `scan` | Full security scan, **low-noise by design** — only flags what's genuinely actionable (writes with no auth, path-traversal params, unschematized bodies, a broad delete surface). Exits non-zero on `high`, so it drops straight into CI. |
| `test` | Call **every tool against the live API** with sample inputs synthesized from each tool's schema, then report what actually works: `pass`, `need-auth`, expected `4xx`, `server-error`, `unreachable`. Read-only by default (mutations skipped unless `--write`). Exits non-zero on real failures — CI-friendly. |
| `monetize` | Emit a **drop-in usage meter + pricing** you own — classifies each tool by cost weight (reads cheap, writes standard, delete/bulk heavy), suggests per-call prices and tiers, and writes a zero-dependency `meter.mjs` that counts credits, enforces quotas, and emits billing events you forward to Stripe / a ledger / a webhook. `--rate `. |
| `generate` | Emit a self-contained MCP server (`server.mjs` + model + `package.json` + README). You own it; deploy anywhere. `--out ./dir`. |
| `serve` | Run the MCP server locally over stdio and log every tool call live, so you can point an agent at it and watch what it does. `--auth "Bearer …"`. |

### Flags

```
--base-url    Override the API base URL (if the spec omits it)
--out         Output directory for `generate` (default ./mcp-server)
--auth      Authorization header forwarded to the backing API
--write            Include write ops (POST/PUT/PATCH/DELETE) when running `test`
--rate      Cents per credit for `monetize` (default 2)
--help, --version
```

## Example

```bash
$ mcpforge init https://petstore3.swagger.io/api/v3/openapi.json

   MF  MCPForge  ›  Swagger Petstore - OpenAPI 3.0 1.0.27

  base url  https://petstore3.swagger.io/api/v3
  tools     19
  auth      petstore_auth, api_key

  ● addPet        POST /pet
  ● getPetById    GET  /pet/{petId}
  …
  ⚠ security  1 medium   (run: mcpforge scan …)
```

```bash
$ mcpforge generate ./openapi.json --out ./my-mcp
$ cd my-mcp && npm install && npm start
#  → a real, protocol-compliant MCP server your agent can connect to.
```

## The security scan is deliberately quiet

Existing MCP scanners are notorious for ~78% false positives — pattern-matching that
fires on everything. MCPForge takes the opposite stance: **few, true findings, each
with a concrete fix.** It flags what actually matters when you hand an API to an
autonomous agent — writes with no auth, path/file params that enable traversal or
SSRF, request bodies with no schema, and a dangerously broad delete surface.

## How it works

```
any OpenAPI spec ──▶ normalized tool model ──▶ ┌─ generate  (deployable server)
   (any language)      (one clean shape)        ├─ scan      (low-noise security)
                                                ├─ test      (live tool verification)
                                                ├─ monetize  (usage meter + pricing)
                                                ├─ serve     (run + inspect calls)
                                                └─ …future stages plug in here
```

Every stage operates on **one normalized model**, never the raw spec — which is what
keeps each stage simple and the input universal. New stages (test, deploy, monetize)
plug into the same model.

## Roadmap

- [x] `init` · `scan` · `test` · `monetize` · `generate` · `serve` — the full lifecycle, verified end-to-end
- [ ] Hosted dashboard (single pane of glass for tools, tests, findings, call logs)
- [ ] One-command deploy
- [ ] Managed billing integrations (Stripe metered billing out of the box)

## Contributing

Issues and PRs welcome. New scanner rules and language/spec edge-cases are especially
useful — the goal is a tool that "just works" on any real-world API.

## License

[MIT](./LICENSE) © Muhammad Adil

## Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [Muhammad-Adil-code](https://github.com/Muhammad-Adil-code)
- **Source:** [Muhammad-Adil-code/Mcp-forge](https://github.com/Muhammad-Adil-code/Mcp-forge)
- **License:** MIT
- **Homepage:** https://www.npmjs.com/package/@muhammad-adil-code/mcp-forge

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/mcp-muhammad-adil-code-mcp-forge
- Seller: https://agentstack.voostack.com/s/muhammad-adil-code
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.