# Openapi To Mcp Skill

> >

- **Type:** Skill
- **Install:** `agentstack add skill-arnie016-codex-prompt-templates-openapi-to-mcp-skill`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [Arnie016](https://agentstack.voostack.com/s/arnie016)
- **Installs:** 0
- **Category:** [AI & ML](https://agentstack.voostack.com/c/ai-and-ml)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [Arnie016](https://github.com/Arnie016)
- **Source:** https://github.com/Arnie016/codex-prompt-templates/tree/main/skills/openapi-to-mcp-skill
- **Website:** https://github.com/Arnie016/codex-prompt-templates

## Install

```sh
agentstack add skill-arnie016-codex-prompt-templates-openapi-to-mcp-skill
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# OpenAPI To MCP Skill

Use this to turn an API into a narrow, safe agent tool surface.

## Workflow

1. Prefer a local OpenAPI/Swagger spec file. If the spec must be fetched, record
   the URL and do not send credentials.
2. Run the read-only surface audit when a local spec is available:

   ```bash
   python3 plugins/codex-supercharge/scripts/openapi_surface_audit.py path/to/openapi.json
   ```

3. Inspect auth, servers, paths, schemas, request bodies, response shapes, rate
   limits, and write methods.
4. Group endpoints into workflows, not raw endpoint dumps.
5. Mark each operation:
   - read-only
   - write
   - destructive
   - admin
   - credential-sensitive
6. Generate a minimal MCP/tool plan or capability manifest.
7. Create a Codex skill that teaches when and how to use the API.
8. Add safety confirmations for write/destructive/admin operations.

## Tool Plan Template

```md
# API Tool Plan
## Auth
## Read Tools
## Write Tools
## Destructive Tools
## Admin And Credential-Sensitive Tools
## Rate Limits
## Error Handling
## Required Confirmations
## Example Prompts
```

## Skill Rule

The skill should describe business workflows, not every endpoint. Keep endpoint
details in a reference file.

## References

- `references/openapi-tool-surface.md`
- `references/mcp-server-catalog.md`
- Source inspiration only, code not executed: `sources/toolcast`
- Capability-manifest inspiration: `sources/roam-code/src/roam/capability.py`

## Skip When

- The API has no spec or stable docs to inspect.
- The user only needs a one-off HTTP call, not an agent/tool surface.
- The task is only MCP conformance/release gating; use
  `$auto-skill-build-mcp-conformance-harness`.

## Validation

- Auth, rate limits, write/destructive operations, and confirmations are explicit.
- Generated tool groups map to workflows rather than raw endpoint dumps.
- Credential-sensitive operations route through `$mcp-safety-review`.
- `openapi_surface_audit.py` was run or the reason it could not run is stated.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [Arnie016](https://github.com/Arnie016)
- **Source:** [Arnie016/codex-prompt-templates](https://github.com/Arnie016/codex-prompt-templates)
- **License:** MIT
- **Homepage:** https://github.com/Arnie016/codex-prompt-templates

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-arnie016-codex-prompt-templates-openapi-to-mcp-skill
- Seller: https://agentstack.voostack.com/s/arnie016
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.