OpenAPI connections
Turn an OpenAPI 3.x document into authorized MCP tools without writing a server.
How it works
Rayrun reads an OpenAPI 3.x document and creates one MCP tool for every supported operation. Tool names come from operationId when present; descriptions, parameters, request bodies, and response behavior come from the document.
When a client calls the tool, Rayrun validates its arguments, builds the HTTP request, adds the stored credential, and returns the upstream response through MCP.
Add an OpenAPI API
Choose Add service, select OpenAPI, and provide a public document URL. Rayrun inspects the document before creating the connection and derives the API title, base URL, authentication type, and operation count.
- Provide an OpenAPI JSON URL.
- Review the detected name and base URL.
- Override the base URL when the document points at a different environment.
- Save the service and provide credentials when required.
Authentication
Rayrun inspects the effective security requirement of operations rather than trusting an unused declaration in the document.
- No authentication for public APIs.
- HTTP Basic with a username and password.
- API keys in a header, bearer authorization, or search parameter.
- OAuth 2.0 authorization code with personal or workspace-shared grants.
For OAuth APIs, Rayrun chooses the least-privilege same-scheme scope alternative when it is unambiguous. It then requests the union of scopes required by the callable operations.
OAuth authorization uses the same personal or workspace-shared credentials, encrypted token storage, refresh, and revocation as remote MCP services.
Rayrun uses discovered provider metadata only when its authorization and token endpoints exactly match the imported document. It registers a provider-bound callback when supported; otherwise, a workspace manager must configure the provider client under Settings → OAuth apps.
Document requirements
- OpenAPI 3.x document served as JSON.
- At least one supported HTTP operation.
- A resolvable HTTP or HTTPS server URL, either in the document or supplied as an override.
- Unique operation identifiers are strongly recommended for stable tool names.