PyPI - mcp-openapi-proxy - Versions diffs - 0.2.0__tar.gz → 0.3.0__tar.gz - Mend

mcp-openapi-proxy 0.2.0tar.gz → 0.3.0tar.gz

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (19) hide show

{mcp_openapi_proxy-0.2.0 → mcp_openapi_proxy-0.3.0}/PKG-INFO RENAMED Viewed

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mcp-openapi-proxy
-Version: 0.2.0
+Version: 0.3.0
 Summary: MCP server for exposing OpenAPI specifications as MCP tools.
 Author-email: Matthew Hand <11550632+matthewhand@users.noreply.github.com>
 Requires-Python: >=3.10
@@ -31,10 +31,11 @@ Dynamic: license-file
 - ✅ **Codex**, **Gemini**, **Qwen**, **Kilocode**, **opencode** — native tool calls over stdio
 - ✅ **Vibe** — native discovery and read calls (writes were CLI-flaky, not a proxy issue)
 - ✅ **Letta** — Cloud (via a remote streamable-HTTP MCP URL) and self-hosted (via stdio)
-- ⚠️ **agy** — could not attach in headless mode; MCP tool enablement is interactive-only in agy (an agy limitation, not the proxy)
 See the [client matrix](#client-matrix) for attach mechanisms, models, and exact results.
+> 📄 Full write-up: [**Verification case study**](docs/verification-case-study.md) — what the proxy is, the API + client matrices, and every defect found & fixed.
 **Prompts and resources are real now — including custom resources.** Both MCP surfaces are functional and tested: the `summarize_spec` / `whimsical_blog` prompts and the `spec_file` resource, plus a new `ADDITIONAL_RESOURCES` env var that serves your *own* use-case documents (e.g. a NetBox naming policy or an Asana project-layout guide) as MCP resources — see `examples/resources/`.
 **Bug fixes (every one live-verified):**
@@ -63,7 +64,7 @@ Full environment-variable reference is in [Environment Variables](#environment-v
 - [Environment Variables](#environment-variables)
 - [Verified Clients & Live Results (2026-06-12)](#verified-clients--live-results-2026-06-12)
   - [Tips](#tips)
-- [Examples](#examples) — Glama, Fly.io, Render, Slack, GetZep, Virustotal, Notion, Asana, APIs.guru, NetBox, Box, WolframAlpha (collapsed)
+- [Examples](#examples) — Glama, Fly.io, Render, Slack, GetZep, Virustotal, Notion, Asana, APIs.guru, NetBox, Box, WolframAlpha, WordPress (collapsed)
 - [Troubleshooting](#troubleshooting)
 - [License](#license)
@@ -174,15 +175,27 @@ The example configurations below were exercised against the live APIs, and the p
 | Agent CLI | Model used (live test) | MCP attach mechanism | Tool calls | Prompts/Resources surfaced to model? |
 |---|---|---|---|---|
-| Codex | `gpt-5-codex` (OpenAI API) | `codex exec -c mcp_servers.*` | ✅ native | ❌ (used raw stdio) |
-| Gemini | Google OAuth free tier (CLI default model) | project `.gemini/settings.json` `mcpServers` | ✅ native | ❌ interactive slash-commands only |
-| Qwen | `agent` group via local LiteLLM gateway | project `.qwen/settings.json` | ✅ native | ❌ NO_PROMPT_ACCESS |
-| Kilocode | `kilo-auto/free` | global `settings/mcp_settings.json`, clean workspace | ✅ native | ❌ |
-| opencode | `orchestration` group via local LiteLLM gateway | `~/.config/opencode/opencode.json` `mcp` | ✅ native | ❌ |
-| Vibe | `mistral-medium-3.5` | `~/.vibe/config.toml` `[[mcp_servers]]` | ✅ discovery + reads (writes flaky) | ❌ |
-| agy | — | — | ❌ headless cannot enable MCP | — |
-| letta cloud | Letta Cloud default | streamable-HTTP MCP URL (`/mcp add --transport http` + bearer) | ✅ remote (stdio rejected) | — |
-| letta (self-hosted ≤0.11.x) | `agent` group via local LiteLLM gateway | stdio via `PUT /v1/tools/mcp/servers` | ✅ native | — |
+| Codex | `gpt-5-codex` (OpenAI API) | `codex exec -c mcp_servers.*` | ✅ native | unknown ‡ |
+| Gemini | Google OAuth free tier (CLI default model) | project `.gemini/settings.json` `mcpServers` | ✅ native | prompts: interactive slash only · resources: ❌ † |
+| Qwen | `agent` group via local LiteLLM gateway | project `.qwen/settings.json` | ✅ native | prompts: ✅ (slash `/summarize_spec`) · resources: ❌ † |
+| Kilocode | `kilo-auto/free` | global `settings/mcp_settings.json`, clean workspace | ✅ native | prompts: ❌ · resources: ✅ (`access_mcp_resource`) † |
+| opencode | `orchestration` group via local LiteLLM gateway | `~/.config/opencode/opencode.json` `mcp` | ✅ native | unknown ‡ |
+| Vibe | `mistral-medium-3.5` | `~/.vibe/config.toml` `[[mcp_servers]]` | ✅ discovery + reads (writes flaky) | prompts: ❌ · resources: ❌ (tools-only) † |
+| agy | — | — | ❌ headless cannot enable MCP | n/a |
+| letta cloud | Letta Cloud default | streamable-HTTP MCP URL (`/mcp add --transport http` + bearer) | ✅ remote (stdio rejected) | unknown ‡ |
+| letta (self-hosted ≤0.11.x) | `agent` group via local LiteLLM gateway | stdio via `PUT /v1/tools/mcp/servers` | ✅ native | unknown ‡ |
+> **Prompts/resources column — read this.** The original 0.2.0 sweep ran while the
+> server advertised prompts/resources **only when `ENABLE_PROMPTS`/`ENABLE_RESOURCES`
+> were set — they defaulted OFF.** Per the MCP spec a client won't call
+> `prompts/list`/`resources/list` unless the capability is advertised, so those early
+> results measured the *server's* default, not the clients. **All prior prompt/resource
+> findings are therefore voided.** This release defaults advertising **on**.
+>
+> - **† re-verified 2026-06-14** with advertising on, against the real client binary. Genuine, uneven: **tools** everywhere; **prompts→model** Qwen (slash) & Gemini (interactive only); **resources→model** Kilocode. Vibe is tools-only (confirmed in source).
+> - **‡ unknown** — not yet re-tested under advertising-on (opencode not installed here; Letta needs a running server + gateway; Codex parked). Prior ❌ values are not carried forward.
+>
+> Tool-calling (the `Tool calls` column) was unaffected by the advertising default and stands as originally verified.
 Minimal sanitized configs per client (the no-auth Glama spec is used as the smallest working example; substitute your own spec URL and `$YOUR_KEY` as needed):
@@ -868,6 +881,55 @@ You can now use the MCP ecosystem to list and invoke WolframAlpha API tools. For
 </details>
+<details>
+<summary><b>Letta (self-hosted + Cloud)</b> — agent platform; stdio for self-hosted, authenticated remote HTTP for Cloud</summary>
+Letta runs agents on a server, so attachment differs by deployment:
+- **Self-hosted Letta** accepts a **stdio** MCP server via `PUT /v1/tools/mcp/servers` — no network exposure.
+- **Letta Cloud** rejects stdio and needs a **remote streamable-HTTP** MCP URL behind authentication.
+Both were verified live (an agent autonomously called `get_v1_attributes` from the Glama spec through the proxy). Full setup for both paths, including the supergateway wrapper and the security note for the Cloud endpoint, is in [`examples/letta/README.md`](examples/letta/README.md).
+</details>
+<details>
+<summary><b>WordPress Example</b> — publish to a real WordPress blog from any MCP agent</summary>
+This example turns the WordPress REST API into MCP tools so an agent can **create, read, update, and trash blog posts**. It is the example behind a real-world demonstration: a fleet of agent CLIs published to the live blog at **[matthewhand.mywebcommunity.org](https://matthewhand.mywebcommunity.org/)** through this proxy — see the write-up [*“Turning Any API into Agent Tools”*](https://matthewhand.mywebcommunity.org/2026/06/12/turning-any-api-into-agent-tools-a-real-world-test-of-mcp-openapi-proxy/), itself posted via the proxy.
+Example config — `examples/wordpress-claude_desktop_config.json`:
+```json
+{
+  "mcpServers": {
+    "wordpress": {
+      "command": "uvx",
+      "args": ["mcp-openapi-proxy"],
+      "env": {
+        "OPENAPI_SPEC_URL": "https://raw.githubusercontent.com/matthewhand/mcp-openapi-proxy/main/examples/wordpress-openapi.json",
+        "SERVER_URL_OVERRIDE": "https://your-site.example.com/wp-json",
+        "EXTRA_HEADERS": "Authorization: Basic BASE64_OF_USERNAME_COLON_APPLICATION_PASSWORD",
+        "IGNORE_SSL_TOOLS": "false",
+        "TOOL_WHITELIST": "/wp/v2/posts"
+      }
+    }
+  }
+}
+```
+Exposed tools (from the bundled `examples/wordpress-openapi.json`): `get_wp_v2_posts`, `post_wp_v2_posts` (create), `get_wp_v2_posts_by_id`, `post_wp_v2_posts_by_id` (update), and `delete_wp_v2_posts_by_id` (trash) — the full post lifecycle.
+**Auth — use a WordPress *Application Password*, not your login password.** WordPress REST rejects login passwords for Basic auth. In `wp-admin → Users → (your user) → Application Passwords`, create one, then base64-encode `username:application-password` for the `EXTRA_HEADERS` value:
+```bash
+printf 'myuser:xxxx xxxx xxxx xxxx xxxx xxxx' | base64 -w0
+```
+Tips: set `IGNORE_SSL_TOOLS=true` only if your host serves a self-signed/mismatched cert; give each agent its own (revocable) application password; keep `TOOL_WHITELIST=/wp/v2/posts` so the agent can touch only posts.
+</details>
 ## Troubleshooting
 ### JSON-RPC Testing

{mcp_openapi_proxy-0.2.0 → mcp_openapi_proxy-0.3.0}/README.md RENAMED Viewed

@@ -9,10 +9,11 @@
 - ✅ **Codex**, **Gemini**, **Qwen**, **Kilocode**, **opencode** — native tool calls over stdio
 - ✅ **Vibe** — native discovery and read calls (writes were CLI-flaky, not a proxy issue)
 - ✅ **Letta** — Cloud (via a remote streamable-HTTP MCP URL) and self-hosted (via stdio)
-- ⚠️ **agy** — could not attach in headless mode; MCP tool enablement is interactive-only in agy (an agy limitation, not the proxy)
 See the [client matrix](#client-matrix) for attach mechanisms, models, and exact results.
+> 📄 Full write-up: [**Verification case study**](docs/verification-case-study.md) — what the proxy is, the API + client matrices, and every defect found & fixed.
 **Prompts and resources are real now — including custom resources.** Both MCP surfaces are functional and tested: the `summarize_spec` / `whimsical_blog` prompts and the `spec_file` resource, plus a new `ADDITIONAL_RESOURCES` env var that serves your *own* use-case documents (e.g. a NetBox naming policy or an Asana project-layout guide) as MCP resources — see `examples/resources/`.
 **Bug fixes (every one live-verified):**
@@ -41,7 +42,7 @@ Full environment-variable reference is in [Environment Variables](#environment-v
 - [Environment Variables](#environment-variables)
 - [Verified Clients & Live Results (2026-06-12)](#verified-clients--live-results-2026-06-12)
   - [Tips](#tips)
-- [Examples](#examples) — Glama, Fly.io, Render, Slack, GetZep, Virustotal, Notion, Asana, APIs.guru, NetBox, Box, WolframAlpha (collapsed)
+- [Examples](#examples) — Glama, Fly.io, Render, Slack, GetZep, Virustotal, Notion, Asana, APIs.guru, NetBox, Box, WolframAlpha, WordPress (collapsed)
 - [Troubleshooting](#troubleshooting)
 - [License](#license)
@@ -152,15 +153,27 @@ The example configurations below were exercised against the live APIs, and the p
 | Agent CLI | Model used (live test) | MCP attach mechanism | Tool calls | Prompts/Resources surfaced to model? |
 |---|---|---|---|---|
-| Codex | `gpt-5-codex` (OpenAI API) | `codex exec -c mcp_servers.*` | ✅ native | ❌ (used raw stdio) |
-| Gemini | Google OAuth free tier (CLI default model) | project `.gemini/settings.json` `mcpServers` | ✅ native | ❌ interactive slash-commands only |
-| Qwen | `agent` group via local LiteLLM gateway | project `.qwen/settings.json` | ✅ native | ❌ NO_PROMPT_ACCESS |
-| Kilocode | `kilo-auto/free` | global `settings/mcp_settings.json`, clean workspace | ✅ native | ❌ |
-| opencode | `orchestration` group via local LiteLLM gateway | `~/.config/opencode/opencode.json` `mcp` | ✅ native | ❌ |
-| Vibe | `mistral-medium-3.5` | `~/.vibe/config.toml` `[[mcp_servers]]` | ✅ discovery + reads (writes flaky) | ❌ |
-| agy | — | — | ❌ headless cannot enable MCP | — |
-| letta cloud | Letta Cloud default | streamable-HTTP MCP URL (`/mcp add --transport http` + bearer) | ✅ remote (stdio rejected) | — |
-| letta (self-hosted ≤0.11.x) | `agent` group via local LiteLLM gateway | stdio via `PUT /v1/tools/mcp/servers` | ✅ native | — |
+| Codex | `gpt-5-codex` (OpenAI API) | `codex exec -c mcp_servers.*` | ✅ native | unknown ‡ |
+| Gemini | Google OAuth free tier (CLI default model) | project `.gemini/settings.json` `mcpServers` | ✅ native | prompts: interactive slash only · resources: ❌ † |
+| Qwen | `agent` group via local LiteLLM gateway | project `.qwen/settings.json` | ✅ native | prompts: ✅ (slash `/summarize_spec`) · resources: ❌ † |
+| Kilocode | `kilo-auto/free` | global `settings/mcp_settings.json`, clean workspace | ✅ native | prompts: ❌ · resources: ✅ (`access_mcp_resource`) † |
+| opencode | `orchestration` group via local LiteLLM gateway | `~/.config/opencode/opencode.json` `mcp` | ✅ native | unknown ‡ |
+| Vibe | `mistral-medium-3.5` | `~/.vibe/config.toml` `[[mcp_servers]]` | ✅ discovery + reads (writes flaky) | prompts: ❌ · resources: ❌ (tools-only) † |
+| agy | — | — | ❌ headless cannot enable MCP | n/a |
+| letta cloud | Letta Cloud default | streamable-HTTP MCP URL (`/mcp add --transport http` + bearer) | ✅ remote (stdio rejected) | unknown ‡ |
+| letta (self-hosted ≤0.11.x) | `agent` group via local LiteLLM gateway | stdio via `PUT /v1/tools/mcp/servers` | ✅ native | unknown ‡ |
+> **Prompts/resources column — read this.** The original 0.2.0 sweep ran while the
+> server advertised prompts/resources **only when `ENABLE_PROMPTS`/`ENABLE_RESOURCES`
+> were set — they defaulted OFF.** Per the MCP spec a client won't call
+> `prompts/list`/`resources/list` unless the capability is advertised, so those early
+> results measured the *server's* default, not the clients. **All prior prompt/resource
+> findings are therefore voided.** This release defaults advertising **on**.
+>
+> - **† re-verified 2026-06-14** with advertising on, against the real client binary. Genuine, uneven: **tools** everywhere; **prompts→model** Qwen (slash) & Gemini (interactive only); **resources→model** Kilocode. Vibe is tools-only (confirmed in source).
+> - **‡ unknown** — not yet re-tested under advertising-on (opencode not installed here; Letta needs a running server + gateway; Codex parked). Prior ❌ values are not carried forward.
+>
+> Tool-calling (the `Tool calls` column) was unaffected by the advertising default and stands as originally verified.
 Minimal sanitized configs per client (the no-auth Glama spec is used as the smallest working example; substitute your own spec URL and `$YOUR_KEY` as needed):
@@ -846,6 +859,55 @@ You can now use the MCP ecosystem to list and invoke WolframAlpha API tools. For
 </details>
+<details>
+<summary><b>Letta (self-hosted + Cloud)</b> — agent platform; stdio for self-hosted, authenticated remote HTTP for Cloud</summary>
+Letta runs agents on a server, so attachment differs by deployment:
+- **Self-hosted Letta** accepts a **stdio** MCP server via `PUT /v1/tools/mcp/servers` — no network exposure.
+- **Letta Cloud** rejects stdio and needs a **remote streamable-HTTP** MCP URL behind authentication.
+Both were verified live (an agent autonomously called `get_v1_attributes` from the Glama spec through the proxy). Full setup for both paths, including the supergateway wrapper and the security note for the Cloud endpoint, is in [`examples/letta/README.md`](examples/letta/README.md).
+</details>
+<details>
+<summary><b>WordPress Example</b> — publish to a real WordPress blog from any MCP agent</summary>
+This example turns the WordPress REST API into MCP tools so an agent can **create, read, update, and trash blog posts**. It is the example behind a real-world demonstration: a fleet of agent CLIs published to the live blog at **[matthewhand.mywebcommunity.org](https://matthewhand.mywebcommunity.org/)** through this proxy — see the write-up [*“Turning Any API into Agent Tools”*](https://matthewhand.mywebcommunity.org/2026/06/12/turning-any-api-into-agent-tools-a-real-world-test-of-mcp-openapi-proxy/), itself posted via the proxy.
+Example config — `examples/wordpress-claude_desktop_config.json`:
+```json
+{
+  "mcpServers": {
+    "wordpress": {
+      "command": "uvx",
+      "args": ["mcp-openapi-proxy"],
+      "env": {
+        "OPENAPI_SPEC_URL": "https://raw.githubusercontent.com/matthewhand/mcp-openapi-proxy/main/examples/wordpress-openapi.json",
+        "SERVER_URL_OVERRIDE": "https://your-site.example.com/wp-json",
+        "EXTRA_HEADERS": "Authorization: Basic BASE64_OF_USERNAME_COLON_APPLICATION_PASSWORD",
+        "IGNORE_SSL_TOOLS": "false",
+        "TOOL_WHITELIST": "/wp/v2/posts"
+      }
+    }
+  }
+}
+```
+Exposed tools (from the bundled `examples/wordpress-openapi.json`): `get_wp_v2_posts`, `post_wp_v2_posts` (create), `get_wp_v2_posts_by_id`, `post_wp_v2_posts_by_id` (update), and `delete_wp_v2_posts_by_id` (trash) — the full post lifecycle.
+**Auth — use a WordPress *Application Password*, not your login password.** WordPress REST rejects login passwords for Basic auth. In `wp-admin → Users → (your user) → Application Passwords`, create one, then base64-encode `username:application-password` for the `EXTRA_HEADERS` value:
+```bash
+printf 'myuser:xxxx xxxx xxxx xxxx xxxx xxxx' | base64 -w0
+```
+Tips: set `IGNORE_SSL_TOOLS=true` only if your host serves a self-signed/mismatched cert; give each agent its own (revocable) application password; keep `TOOL_WHITELIST=/wp/v2/posts` so the agent can touch only posts.
+</details>
 ## Troubleshooting
 ### JSON-RPC Testing

{mcp_openapi_proxy-0.2.0 → mcp_openapi_proxy-0.3.0}/mcp_openapi_proxy/server_lowlevel.py RENAMED Viewed

@@ -14,8 +14,8 @@ Configuration is controlled via environment variables:
 - CAPABILITIES_RESOURCES: Set to "true" to enable resources advertising (default: false).
 - CAPABILITIES_PROMPTS: Set to "true" to enable prompts advertising (default: false).
 - ENABLE_TOOLS: Set to "false" to disable tools functionality (default: true).
-- ENABLE_RESOURCES: Set to "true" to enable resources functionality (default: false).
-- ENABLE_PROMPTS: Set to "true" to enable prompts functionality (default: false).
+- ENABLE_RESOURCES: Set to "false" to disable resources functionality (default: true).
+- ENABLE_PROMPTS: Set to "false" to disable prompts functionality (default: true).
 """
 import os
@@ -53,10 +53,13 @@ CAPABILITIES_TOOLS = os.getenv("CAPABILITIES_TOOLS", "false").lower() == "true"
 CAPABILITIES_RESOURCES = os.getenv("CAPABILITIES_RESOURCES", "false").lower() == "true"
 CAPABILITIES_PROMPTS = os.getenv("CAPABILITIES_PROMPTS", "false").lower() == "true"
-# Check feature enablement envvars (tools on, others off by default)
+# Feature enablement (all on by default). Advertising a capability is
+# required for clients to even attempt prompts/list & resources/list;
+# defaulting these OFF made prompts/resources invisible to every client
+# despite being implemented. Set to "false" to opt out.
 ENABLE_TOOLS = os.getenv("ENABLE_TOOLS", "true").lower() == "true"
-ENABLE_RESOURCES = os.getenv("ENABLE_RESOURCES", "false").lower() == "true"
-ENABLE_PROMPTS = os.getenv("ENABLE_PROMPTS", "false").lower() == "true"
+ENABLE_RESOURCES = os.getenv("ENABLE_RESOURCES", "true").lower() == "true"
+ENABLE_PROMPTS = os.getenv("ENABLE_PROMPTS", "true").lower() == "true"
 # Resource and prompt DEFINITIONS are always present so the feature is
 # deterministically testable. Whether they are EXPOSED to clients is gated
@@ -408,7 +411,7 @@ async def read_resource(request: types.ReadResourceRequest) -> types.ReadResourc
                 ]
             )
         logger.debug("Dumping spec to JSON...")
-        spec_json = json.dumps(spec_data, indent=2)
+        spec_json = json.dumps(spec_data, indent=2, default=str)
         logger.debug(f"Forcing spec JSON return: {spec_json[:50]}...")
         return types.ReadResourceResult(
             contents=[

{mcp_openapi_proxy-0.2.0 → mcp_openapi_proxy-0.3.0}/mcp_openapi_proxy/utils.py RENAMED Viewed

@@ -14,6 +14,28 @@ from mcp import types
 # Import the configured logger
 from .logging_setup import logger
+class _NoTimestampSafeLoader(yaml.SafeLoader):
+    """SafeLoader that keeps unquoted RFC3339 timestamps as plain strings.
+    PyYAML's SafeLoader auto-converts values like ``2015-02-22T20:00:45.000Z``
+    into Python ``datetime`` objects. Such objects are not JSON-serializable,
+    which crashed spec caching and ``resources/read`` for specs that carry
+    datetime example values (e.g. the apis.guru directory spec). Loading specs
+    with this loader keeps every scalar JSON-safe.
+    """
+_NoTimestampSafeLoader.yaml_implicit_resolvers = {
+    key: [(tag, regexp) for tag, regexp in resolvers if tag != "tag:yaml.org,2002:timestamp"]
+    for key, resolvers in yaml.SafeLoader.yaml_implicit_resolvers.items()
+}
+def yaml_load_safe(content: str):
+    """Parse YAML with timestamps preserved as strings (JSON-safe)."""
+    return yaml.load(content, Loader=_NoTimestampSafeLoader)
 def setup_logging(debug: bool = False):
     """
     Configure logging for the application.
@@ -196,7 +218,7 @@ def _spec_cache_store(url: str, spec: Dict) -> None:
     try:
         path = _spec_cache_path(url)
         with open(path + ".tmp", "w") as f:
-            json.dump(spec, f)
+            json.dump(spec, f, default=str)
         os.replace(path + ".tmp", path)
         logger.debug(f"Cached spec for {url} at {path}")
     except OSError as exc:
@@ -226,7 +248,7 @@ def fetch_openapi_spec(url: str, retries: int = 3) -> Optional[Dict]:
                 logger.debug(f"Using {spec_format.upper()} parser based on OPENAPI_SPEC_FORMAT env var")
                 if spec_format == "yaml":
                     try:
-                        spec = yaml.safe_load(content)
+                        spec = yaml_load_safe(content)
                         logger.debug(f"Parsed as YAML from {url}")
                     except yaml.YAMLError as ye:
                         logger.error(f"YAML parsing failed: {ye}. Raw content: {content[:500]}...")
@@ -252,7 +274,7 @@ def fetch_openapi_spec(url: str, retries: int = 3) -> Optional[Dict]:
                     logger.debug(f"Parsed as JSON from {url}")
                 except json.JSONDecodeError:
                     try:
-                        spec = yaml.safe_load(content)
+                        spec = yaml_load_safe(content)
                         logger.debug(f"Parsed as YAML from {url}")
                     except yaml.YAMLError as ye:
                         logger.error(f"YAML parsing failed: {ye}. Raw content: {content[:500]}...")

{mcp_openapi_proxy-0.2.0 → mcp_openapi_proxy-0.3.0}/mcp_openapi_proxy.egg-info/PKG-INFO RENAMED Viewed

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mcp-openapi-proxy
-Version: 0.2.0
+Version: 0.3.0
 Summary: MCP server for exposing OpenAPI specifications as MCP tools.
 Author-email: Matthew Hand <11550632+matthewhand@users.noreply.github.com>
 Requires-Python: >=3.10
@@ -31,10 +31,11 @@ Dynamic: license-file
 - ✅ **Codex**, **Gemini**, **Qwen**, **Kilocode**, **opencode** — native tool calls over stdio
 - ✅ **Vibe** — native discovery and read calls (writes were CLI-flaky, not a proxy issue)
 - ✅ **Letta** — Cloud (via a remote streamable-HTTP MCP URL) and self-hosted (via stdio)
-- ⚠️ **agy** — could not attach in headless mode; MCP tool enablement is interactive-only in agy (an agy limitation, not the proxy)
 See the [client matrix](#client-matrix) for attach mechanisms, models, and exact results.
+> 📄 Full write-up: [**Verification case study**](docs/verification-case-study.md) — what the proxy is, the API + client matrices, and every defect found & fixed.
 **Prompts and resources are real now — including custom resources.** Both MCP surfaces are functional and tested: the `summarize_spec` / `whimsical_blog` prompts and the `spec_file` resource, plus a new `ADDITIONAL_RESOURCES` env var that serves your *own* use-case documents (e.g. a NetBox naming policy or an Asana project-layout guide) as MCP resources — see `examples/resources/`.
 **Bug fixes (every one live-verified):**
@@ -63,7 +64,7 @@ Full environment-variable reference is in [Environment Variables](#environment-v
 - [Environment Variables](#environment-variables)
 - [Verified Clients & Live Results (2026-06-12)](#verified-clients--live-results-2026-06-12)
   - [Tips](#tips)
-- [Examples](#examples) — Glama, Fly.io, Render, Slack, GetZep, Virustotal, Notion, Asana, APIs.guru, NetBox, Box, WolframAlpha (collapsed)
+- [Examples](#examples) — Glama, Fly.io, Render, Slack, GetZep, Virustotal, Notion, Asana, APIs.guru, NetBox, Box, WolframAlpha, WordPress (collapsed)
 - [Troubleshooting](#troubleshooting)
 - [License](#license)
@@ -174,15 +175,27 @@ The example configurations below were exercised against the live APIs, and the p
 | Agent CLI | Model used (live test) | MCP attach mechanism | Tool calls | Prompts/Resources surfaced to model? |
 |---|---|---|---|---|
-| Codex | `gpt-5-codex` (OpenAI API) | `codex exec -c mcp_servers.*` | ✅ native | ❌ (used raw stdio) |
-| Gemini | Google OAuth free tier (CLI default model) | project `.gemini/settings.json` `mcpServers` | ✅ native | ❌ interactive slash-commands only |
-| Qwen | `agent` group via local LiteLLM gateway | project `.qwen/settings.json` | ✅ native | ❌ NO_PROMPT_ACCESS |
-| Kilocode | `kilo-auto/free` | global `settings/mcp_settings.json`, clean workspace | ✅ native | ❌ |
-| opencode | `orchestration` group via local LiteLLM gateway | `~/.config/opencode/opencode.json` `mcp` | ✅ native | ❌ |
-| Vibe | `mistral-medium-3.5` | `~/.vibe/config.toml` `[[mcp_servers]]` | ✅ discovery + reads (writes flaky) | ❌ |
-| agy | — | — | ❌ headless cannot enable MCP | — |
-| letta cloud | Letta Cloud default | streamable-HTTP MCP URL (`/mcp add --transport http` + bearer) | ✅ remote (stdio rejected) | — |
-| letta (self-hosted ≤0.11.x) | `agent` group via local LiteLLM gateway | stdio via `PUT /v1/tools/mcp/servers` | ✅ native | — |
+| Codex | `gpt-5-codex` (OpenAI API) | `codex exec -c mcp_servers.*` | ✅ native | unknown ‡ |
+| Gemini | Google OAuth free tier (CLI default model) | project `.gemini/settings.json` `mcpServers` | ✅ native | prompts: interactive slash only · resources: ❌ † |
+| Qwen | `agent` group via local LiteLLM gateway | project `.qwen/settings.json` | ✅ native | prompts: ✅ (slash `/summarize_spec`) · resources: ❌ † |
+| Kilocode | `kilo-auto/free` | global `settings/mcp_settings.json`, clean workspace | ✅ native | prompts: ❌ · resources: ✅ (`access_mcp_resource`) † |
+| opencode | `orchestration` group via local LiteLLM gateway | `~/.config/opencode/opencode.json` `mcp` | ✅ native | unknown ‡ |
+| Vibe | `mistral-medium-3.5` | `~/.vibe/config.toml` `[[mcp_servers]]` | ✅ discovery + reads (writes flaky) | prompts: ❌ · resources: ❌ (tools-only) † |
+| agy | — | — | ❌ headless cannot enable MCP | n/a |
+| letta cloud | Letta Cloud default | streamable-HTTP MCP URL (`/mcp add --transport http` + bearer) | ✅ remote (stdio rejected) | unknown ‡ |
+| letta (self-hosted ≤0.11.x) | `agent` group via local LiteLLM gateway | stdio via `PUT /v1/tools/mcp/servers` | ✅ native | unknown ‡ |
+> **Prompts/resources column — read this.** The original 0.2.0 sweep ran while the
+> server advertised prompts/resources **only when `ENABLE_PROMPTS`/`ENABLE_RESOURCES`
+> were set — they defaulted OFF.** Per the MCP spec a client won't call
+> `prompts/list`/`resources/list` unless the capability is advertised, so those early
+> results measured the *server's* default, not the clients. **All prior prompt/resource
+> findings are therefore voided.** This release defaults advertising **on**.
+>
+> - **† re-verified 2026-06-14** with advertising on, against the real client binary. Genuine, uneven: **tools** everywhere; **prompts→model** Qwen (slash) & Gemini (interactive only); **resources→model** Kilocode. Vibe is tools-only (confirmed in source).
+> - **‡ unknown** — not yet re-tested under advertising-on (opencode not installed here; Letta needs a running server + gateway; Codex parked). Prior ❌ values are not carried forward.
+>
+> Tool-calling (the `Tool calls` column) was unaffected by the advertising default and stands as originally verified.
 Minimal sanitized configs per client (the no-auth Glama spec is used as the smallest working example; substitute your own spec URL and `$YOUR_KEY` as needed):
@@ -868,6 +881,55 @@ You can now use the MCP ecosystem to list and invoke WolframAlpha API tools. For
 </details>
+<details>
+<summary><b>Letta (self-hosted + Cloud)</b> — agent platform; stdio for self-hosted, authenticated remote HTTP for Cloud</summary>
+Letta runs agents on a server, so attachment differs by deployment:
+- **Self-hosted Letta** accepts a **stdio** MCP server via `PUT /v1/tools/mcp/servers` — no network exposure.
+- **Letta Cloud** rejects stdio and needs a **remote streamable-HTTP** MCP URL behind authentication.
+Both were verified live (an agent autonomously called `get_v1_attributes` from the Glama spec through the proxy). Full setup for both paths, including the supergateway wrapper and the security note for the Cloud endpoint, is in [`examples/letta/README.md`](examples/letta/README.md).
+</details>
+<details>
+<summary><b>WordPress Example</b> — publish to a real WordPress blog from any MCP agent</summary>
+This example turns the WordPress REST API into MCP tools so an agent can **create, read, update, and trash blog posts**. It is the example behind a real-world demonstration: a fleet of agent CLIs published to the live blog at **[matthewhand.mywebcommunity.org](https://matthewhand.mywebcommunity.org/)** through this proxy — see the write-up [*“Turning Any API into Agent Tools”*](https://matthewhand.mywebcommunity.org/2026/06/12/turning-any-api-into-agent-tools-a-real-world-test-of-mcp-openapi-proxy/), itself posted via the proxy.
+Example config — `examples/wordpress-claude_desktop_config.json`:
+```json
+{
+  "mcpServers": {
+    "wordpress": {
+      "command": "uvx",
+      "args": ["mcp-openapi-proxy"],
+      "env": {
+        "OPENAPI_SPEC_URL": "https://raw.githubusercontent.com/matthewhand/mcp-openapi-proxy/main/examples/wordpress-openapi.json",
+        "SERVER_URL_OVERRIDE": "https://your-site.example.com/wp-json",
+        "EXTRA_HEADERS": "Authorization: Basic BASE64_OF_USERNAME_COLON_APPLICATION_PASSWORD",
+        "IGNORE_SSL_TOOLS": "false",
+        "TOOL_WHITELIST": "/wp/v2/posts"
+      }
+    }
+  }
+}
+```
+Exposed tools (from the bundled `examples/wordpress-openapi.json`): `get_wp_v2_posts`, `post_wp_v2_posts` (create), `get_wp_v2_posts_by_id`, `post_wp_v2_posts_by_id` (update), and `delete_wp_v2_posts_by_id` (trash) — the full post lifecycle.
+**Auth — use a WordPress *Application Password*, not your login password.** WordPress REST rejects login passwords for Basic auth. In `wp-admin → Users → (your user) → Application Passwords`, create one, then base64-encode `username:application-password` for the `EXTRA_HEADERS` value:
+```bash
+printf 'myuser:xxxx xxxx xxxx xxxx xxxx xxxx' | base64 -w0
+```
+Tips: set `IGNORE_SSL_TOOLS=true` only if your host serves a self-signed/mismatched cert; give each agent its own (revocable) application password; keep `TOOL_WHITELIST=/wp/v2/posts` so the agent can touch only posts.
+</details>
 ## Troubleshooting
 ### JSON-RPC Testing

{mcp_openapi_proxy-0.2.0 → mcp_openapi_proxy-0.3.0}/pyproject.toml RENAMED Viewed

@@ -5,7 +5,7 @@ build-backend = "setuptools.build_meta"
 [project]
 name = "mcp-openapi-proxy"
 requires-python = ">=3.10"
-version = "0.2.0"
+version = "0.3.0"
 description = "MCP server for exposing OpenAPI specifications as MCP tools."
 readme = "README.md"
 authors = [