Ranked roundup · REST APIs
Best MCP Server for REST API Integration
There is no single official MCP server for REST APIs, because REST is a category, not a vendor — so this page ranks the tools that turn an arbitrary REST API into MCP tools, almost all of them by reading an OpenAPI spec. The closest thing to a vendor-backed option is AWS Labs' openapi-mcp-server, which lives in AWS's 9,651-star MCP monorepo and was committed to as recently as August 26, 2026. The community fills in the rest with runtime proxies and code generators, and Zapier MCP covers the no-code end through its 9,000-app catalog. One warning up front: the most-starred repo named "openapi-mcp-server" (899 stars) no longer calls APIs at all — it pivoted to spec exploration — which is why it is not ranked here. Rankings come from verifiable criteria only: vendor backing, last push date, adoption, auth model, and documented capabilities. No paid placement, no invented benchmarks.
Facts checked September 1, 2026 · ranked on verifiable criteria · placement is never for sale
Founder, Automation Squad ·
The ranking
- Community
The default choice: most-maintained generic OpenAPI-to-MCP server with the strongest documented security posture
Dynamically generates MCP tools from any OpenAPI spec and executes the REST calls. Hardened by default: HTTPS required, private networks and external $refs blocked, DNS-rebinding protection, redirects not followed, 10 MiB spec cap. Installs via pip or uvx (awslabs.openapi-mcp-server), stdio transport.
Self-hosted, local stdio process (pip/uvx) · Basic, Bearer token, API key (header/query/cookie), and AWS Cognito; each additional spec can declare independent credentials · Apache-2.0 · 9,651★
- The 9,651 stars belong to the whole awslabs/mcp monorepo, not this one server — per-server adoption can't be measured from GitHub
- No generic OAuth 2.0 flow support beyond Cognito; interactive-OAuth APIs need credentials pre-provisioned
- Strict defaults (HTTPS-only, private networks blocked) require explicit flags to reach localhost or internal APIs
- Requires an OpenAPI spec — it cannot wrap an undocumented API
- Community
Teams that want generated code they can audit, extend, and deploy as their own artifact
CLI that converts an OpenAPI spec into a standalone, MCP-compatible server project that proxies requests to your REST API, with a choice of transport methods. Highest-starred actively maintained community project in this category.
Self-hosted — you run (and deploy) the generated server wherever you like · Credentials configured in the generated server code/env — you control the auth layer because you own the output · MIT · 632★
- It's a code generator, not a runtime: when your API spec changes, you regenerate or hand-edit
- Community-maintained by an individual, no vendor backing
- Last push June 15, 2026 — about 2.5 months before verification
- Community
Config-driven runtime use, especially against internal APIs that need mutual TLS or a private CA
Runtime TypeScript server: point it at a spec and it exposes endpoints as MCP tools, with endpoint filtering, stdio and HTTP transports, and optional MCP prompts/resources.
Self-hosted (npm/npx), stdio or HTTP · Static headers via API_HEADERS (Bearer, API keys), mutual TLS with client certs and custom CAs, plus an AuthProvider guide for dynamic patterns · MIT · 289★
- Default auth is static headers set at launch — no OAuth flows out of the box
- Community-maintained by an individual
- Requires an OpenAPI spec
- Official · Zapier (official product, in beta) — the managed, no-code path
Non-developers, and anyone whose 'REST APIs' are really mainstream SaaS apps Zapier already integrates
Hosted MCP endpoint over Zapier's catalog of 9,000+ apps and 30,000+ actions; arbitrary endpoints are reachable through Zapier's webhooks/API actions rather than an OpenAPI spec. Included in all Zapier plans with audit logging and admin permission controls.
Fully managed by Zapier — nothing to run · Handled by Zapier: your existing app connections (including OAuth) carry over to MCP with no separate credential setup
- In beta at verification time
- Each MCP action call consumes two Zapier tasks from your plan's quota — costs scale with usage
- The arbitrary-endpoint path (Webhooks by Zapier) is gated to paid plans; the product is app-catalog-first, not spec-driven
- All traffic routes through Zapier's cloud — a non-starter for private/internal APIs
- Community
APIs with non-standard auth schemes that break the stricter servers above
Python runtime proxy: set OPENAPI_SPEC_URL and it dynamically registers every valid endpoint as an MCP tool, with a simpler FastMCP mode, tool whitelisting, and spec caching. Pushed August 30, 2026 — the freshest community option verified.
Self-hosted (PyPI/uvx), stdio · API_KEY as Bearer by default, overridable schemes (e.g. 'Token', named API-key headers), extra custom headers, and JMESPath payload auth for APIs like Slack that put tokens in the request body · MIT · 153★
- Smallest adoption on this list at 153 stars
- Sparse presentation — the repo has no description and the README leans on changelog-style bug notes
- Single-credential model per instance; multi-API setups need multiple server entries
REST APIs MCP servers compared
| Server | Maintained by | Runs | Auth | License |
|---|---|---|---|---|
| AWS Labs OpenAPI MCP Server | Community | Self-hosted, local stdio process (pip/uvx) | Basic, Bearer token, API key (header/query/cookie), and AWS Cognito; each additional spec can declare independent credentials | Apache-2.0 |
| openapi-mcp-generator | Community | Self-hosted — you run (and deploy) the generated server wherever you like | Credentials configured in the generated server code/env — you control the auth layer because you own the output | MIT |
| mcp-openapi-server (ivo-toby) | Community | Self-hosted (npm/npx), stdio or HTTP | Static headers via API_HEADERS (Bearer, API keys), mutual TLS with client certs and custom CAs, plus an AuthProvider guide for dynamic patterns | MIT |
| Zapier MCP | Zapier (official product, in beta) — the managed, no-code path | Fully managed by Zapier — nothing to run | Handled by Zapier: your existing app connections (including OAuth) carry over to MCP with no separate credential setup | — |
| mcp-openapi-proxy | Community | Self-hosted (PyPI/uvx), stdio | API_KEY as Bearer by default, overridable schemes (e.g. 'Token', named API-key headers), extra custom headers, and JMESPath payload auth for APIs like Slack that put tokens in the request body | MIT |
How to choose
Pick AWS Labs' openapi-mcp-server if you want the most-maintained option with real security defaults (HTTPS-only, SSRF protections) and standard auth schemes. Pick openapi-mcp-generator if you want generated code you own and can edit, and don't mind regenerating when the spec changes. Pick ivo-toby's mcp-openapi-server if you need endpoint filtering, HTTP transport, or mutual TLS to internal APIs. Pick mcp-openapi-proxy if your API uses an awkward auth scheme (payload tokens, custom header prefixes). Pick Zapier MCP if you'd rather not host anything and your targets are mainstream SaaS apps.
How this ranking works
Every server here is real and was checked against its repository or vendor documentation on the date above — stars and licenses come from the GitHub API, not from memory. Order reflects verifiable criteria only: official support, maintenance recency, adoption, auth model, and documented capability coverage. We do not run paid placements, and we list every caveat we find, including the unflattering ones.
Common questions
- Is there an official MCP server for REST APIs?
- No — REST is a standard, not a company, so no one owns the category. The closest to vendor-backed is AWS Labs' openapi-mcp-server inside the awslabs/mcp monorepo (Apache-2.0, committed August 26, 2026); Anthropic's reference servers don't include a generic authenticated REST caller.
- What does setup and auth actually look like?
- Every self-hosted option on this list requires an OpenAPI spec for your API — that's the input, not optional. Auth is almost always static credentials set at launch (Bearer token, API key, or Basic via env vars or headers); none of the community servers run interactive OAuth flows for you, and AWS Labs only goes further with Cognito support. If your target needs OAuth, Zapier MCP is the path that handles it, because your existing Zapier app connections carry over.
- Why isn't the most-starred 'openapi-mcp-server' ranked here?
- The 899-star repo (janwilmake/openapi-mcp-server, formerly snaggle-ai) pivoted: it now searches and explains OpenAPI specs via oapis.org rather than executing API calls. It's a useful spec-exploration companion, but it doesn't do the job this page ranks.
- What if my API has no OpenAPI spec?
- You're mostly out of luck with the self-hosted servers — all four verified here consume a spec. Your options are writing a minimal spec for the endpoints you need, or using Zapier's webhooks/API actions, which take raw endpoint details instead (on paid plans).
MCP servers we build
Automation Squad publishes its own open-source MCP servers and agent skills, documented with the same rules this ranking uses.