Turn your API into tools AI agents can call.
One command reads your OpenAPI spec and writes a WebMCP tool for every endpoint: typed, checked for safety, and committed to your repo as code you own. It comes with a local playground to review and test them.
Not a dumb API → WebMCP converter.
Point a generator at an API without thinking and you ship every route as something an agent can call. The interesting problem was never can an agent call your app; it is what it should be allowed to call. So every generation runs an audit, and the audit has opinions.
✕ webhook receivers
Endpoints that exist for other servers, not for users. An agent holding a tool that fires your payment-webhook route is a breach waiting for a curious prompt.
✕ admin operations
Anything under admin-only paths, role-gated actions, destructive-by-default routes. Flagged as errors: generation stops until a human decides.
✕ auth boundaries
Login, signup, token refresh. An agent should never carry your user's credentials into a model context. Blocked, always.
Your API changes. Your tools keep up.
Re-run the command whenever the spec moves. Regeneration never touches code you wrote. The exact behavior:
an endpoint is added
a new file appears, with space for your code
the spec changed
only the part generated from the spec updates
nothing changed
nothing gets rewritten, and your git history stays quiet
you edited the generated part
your version wins; the update waits in a separate file
What's the catch?
The usual ones aren't here.
The files are yours. Plain TypeScript in your repo. Read them, diff them, edit them. They never import this package, so uninstalling it changes nothing.
It never phones home. No account, no telemetry, no uploads. It reads a local file and writes local files.
You review before anything is written. The first run shows every file and every warning, and writes nothing.
The stack
One product of a stack.
codegen is the first product of : the layer that turns contracts into tools. The rest of the loop is on the roadmap: @webmcp-stack/telemetry to see how agents actually use your tools, and @webmcp-stack/audit to check any site’s WebMCP surface with a URL.
why the stack exists →Point it at your spec.
The first run writes nothing. It only shows you the tools hiding in your API.