Skip to content
openapi-mcp

openapi-mcp-generator vs AWS Labs OpenAPI MCP Server

openapi-mcp-generator vs awslabs.openapi-mcp-server: runtime vs codegen, transports, Cognito and API auth, SSRF protections, validation and when to choose each.

By Updated

Disclosure: I maintain openapi-mcp-generator. AWS facts come from the awslabs/mcp repository, PyPI and a run of awslabs.openapi-mcp-server 1.1.6 against the Swagger Petstore on 24 October 2026.

TL;DR#

Choose the AWS Labs OpenAPI MCP Server if you want a local stdio server you start with one uvx command, with Cognito authentication, multi-spec composition, hardened spec loading and no code to maintain. Choose openapi-mcp-generator if you need a remote HTTP or Cloudflare Workers server, per-operation credentials from your spec, or a TypeScript project you can edit. Both expose one tool per operation from OpenAPI 3.x and returned the same 19 Petstore tools in our test.

What the AWS Labs server does better#

  • Zero build step. uvx awslabs.openapi-mcp-server@latest with an API URL and spec URL is the whole setup. The spec is reread every start.
  • Cognito support. Besides basic, bearer and API key, it supports Amazon Cognito with a password flow and an OAuth 2.0 client credentials flow. openapi-mcp-generator has no Cognito-specific mode.
  • Multi-spec composition. --additional-specs combines several OpenAPI documents in one server, each with its own credentials.
  • Hardened spec loading. Its README documents SSRF checks with DNS pinning, refusal of external $refs, no redirects, a 10 MiB spec cap and path restrictions for local specs. openapi-mcp-generator rejects external http(s) $refs by default but does not document the rest.
  • Richer descriptions. It appends response codes and examples to tool descriptions (we saw this on getPetById) and generates operation prompts.
  • Operations features. Optional Prometheus metrics, caching and retry logic, plus a Dockerfile.

Comparison table#

Dimension AWS Labs OpenAPI MCP Server openapi-mcp-generator
Language Python (3.10+), built on FastMCP (1.1.6 ran FastMCP 3.4.11) TypeScript output; Node 22+
Model Runtime: reads the spec at startup Code generation: writes a project you own
OpenAPI versions "OpenAPI 3.x" per README; JSON, YAML with the [yaml] extra 3.0.x and 3.1.x; 3.2.0 rejected; Swagger 2.0 refused with a hint (our test)
Transports stdio (README; the server source says "stdio transport only"). DEPLOYMENT.md still discusses SSE stdio, Streamable HTTP, HTTP+SSE, Cloudflare Worker
Upstream auth One configuration per spec: none, basic, bearer, API key (header, query, cookie), Cognito Per operation from securitySchemes: API key, bearer, basic, OAuth2 client credentials and password grant, OIDC token; fails closed
Inbound auth Not applicable for stdio --inbound-auth bearer, --header-passthrough for HTTP transports
Tool curation --include-tags, --exclude-tags x-mcp, --default-include, tag and operation include/exclude
Schema validation Response schema validation on by default (--no-validate-output disables). An invalid petId: "abc" reached the API, which returned 400, in our test Arguments validated before the request; outputs enforced with --output-schema
Annotations / structured output No annotations in our test; outputSchema declared and structuredContent returned Method-based annotations; structuredContent for objects; outputSchema opt-in
Extras Operation prompts, enriched descriptions, Prometheus, caching, retries, Docker Browser playground on HTTP servers, Workers project, server instructions from info.description
Hosting Local process or container Local, any Node host, Cloudflare Workers
License / price Apache-2.0, free MIT, free
Maintenance signals PyPI 1.1.6 released 8 September 2026; last commit touching the package 8 September 2026; awslabs/mcp monorepo has 9,827 stars npm 5.0.1 published 24 October 2026; 640 stars

Model#

Both servers answer the same question differently. The AWS server is an application you configure with flags or environment variables. openapi-mcp-generator gives you source code. If you never want to touch TypeScript, the AWS server is less work. If you want to change request handling, add a custom tool or review every tool definition, generated code is easier. For request-level results from both servers on the same two specs, see OpenAPI to MCP generators compared.

Transports and hosting#

The AWS README says the server supports stdio, and the current source (unchanged since the 1.1.6 release on 8 September 2026) runs it with stdio only. Its DEPLOYMENT.md still discusses SSE on EKS, so treat remote deployment as unverified. If you need a URL that Claude.ai, Cursor or other remote clients can reach, openapi-mcp-generator's streamable-http and cloudflare-worker targets fit better.

Authentication#

The AWS server applies one credential configuration to the primary spec, with separate settings for each additional spec. That is simple and works well when one token covers the API. openapi-mcp-generator reads each operation's security requirements and picks the matching credential, which helps with APIs that mix schemes, and it refuses to call the API when a required credential is missing. In our Petstore run the AWS server called getPetById without a key and succeeded, because the public demo does not enforce its declared security. openapi-mcp-generator blocked the same call until a key was set.

Curation#

AWS filters by tag only. openapi-mcp-generator adds per-operation and per-path control through x-mcp and operationId filters. Neither has a dynamic tool discovery mode.

Who each is for#

  • AWS Labs server: developers who want a local stdio bridge to an API in minutes, AWS teams using Cognito, and anyone combining several specs in one server.
  • openapi-mcp-generator: teams that need remote HTTP or Workers deployment, editable code, per-operation auth and inbound bearer protection.

Switching#

  • AWS to openapi-mcp-generator: generate from the same spec URL with -b set to your API_BASE_URL. Move --include-tags/--exclude-tags to the same generator flags. Replace AUTH_TYPE settings with the per-scheme variables listed in .env.example. Cognito needs a pre-acquired token or OAuth2 client credentials defined in the spec. Each additional spec becomes its own generated server.
  • openapi-mcp-generator to AWS: point API_SPEC_URL and API_BASE_URL at the same API and choose one AUTH_TYPE. You lose HTTP transports and method-based annotations, and gain operation prompts.

FAQ#

Does the AWS Labs OpenAPI MCP Server work outside AWS? Yes. We ran it against the public Swagger Petstore with uvx. Cognito support is optional.

Is it a code generator? No. It builds tools at runtime from the spec, using FastMCP's OpenAPI integration.

Can it run as a remote server? The README lists stdio. Remote use is not verified here.

Which one validates tool inputs locally? openapi-mcp-generator rejected an invalid argument before the request in our test. The AWS server forwarded it and returned the API's 400.

Last verified 24 October 2026.

Sources#

All comparisons