v0.2.0 — The Verification Sweep

mcp-openapi-proxy 0.2.0 — “The Verification Sweep”

The release that makes any OpenAPI spec a first-class MCP server — now proven against real APIs and every mainstream MCP client.

🔁 This is the first real semver release. Earlier PyPI uploads were auto-stamped 0.1.<timestamp>; the publish pipeline now honors pyproject.toml, so 0.2.0 is the new baseline.

✨ Highlights

Works with every modern MCP client we tested. Strict clients used to see zero tools (empty capabilities + a resource-discovery crash). Fixed — and verified live end-to-end:

Client	Result
Codex · Gemini · Qwen · Kilocode · opencode	✅ native tool calls over stdio
Vibe	✅ discovery + read calls
Letta	✅ Cloud (remote HTTP MCP) and self-hosted (stdio)
agy	⚠️ headless can’t enable MCP (an agy limitation)

Prompts & resources are real — including your own. summarize_spec, whimsical_blog, the spec_file resource, plus the new ADDITIONAL_RESOURCES env var to serve use-case docs (a NetBox naming policy, an Asana project layout…) straight to the agent. See examples/resources/.

11 APIs verified through the proxy — Slack, Asana, Notion, NetBox, Render, ElevenLabs, Fly.io, VirusTotal, WolframAlpha, Glama, APIs.guru — across 6 agent CLIs, zero custom server code.

🐛 Fixed

• Strict-client discovery: empty capabilities + resource crash → zero tools (#23)
• Crash-loop when a slow spec outran a client’s connect timeout (#28)
• IGNORE_SSL_TOOLS ignored by the low-level dispatcher (#14)
• API_AUTH_TYPE custom schemes (e.g. NetBox Token) sent no auth header (#24)
• TOOL_WHITELIST never matched Slack dot-paths like /users.list (#27)
• TOOL_NAME_MAX_LENGTH ignored; truncation collisions silently dropped tools (#11)
• Array params emitted without items → rejected by the OpenAI API (#16)
• Dead Render spec URL (#26); incomplete ElevenLabs example (#29)

➕ Added

• ADDITIONAL_RESOURCES — custom MCP resources (#33)
• EXTRA_HEADERS now accepts a JSON array and literal \n, not just newlines (#17)
• Live-first spec cache (OPENAPI_SPEC_CACHE_TTL_SECONDS) — served only when a live fetch stalls
• Dockerfile + glama.json for the Glama listing (#13)
• Self-hosted Zep CE path for the GetZep example (hosted endpoint now 401s) (#38)
• README: What’s New, collapsible examples, verified-client & API matrices (#35)

🔧 Environment variables

Variable	Change
OPENAPI_SPEC_CACHE_TTL_SECONDS	new (default 86400; 0 disables)
ADDITIONAL_RESOURCES	new
API_AUTH_TYPE	extended: unknown values become a custom scheme prefix
EXTRA_HEADERS	now accepts JSON array / literal \n
API_AUTH_HEADER, ENABLE_*, CAPABILITIES_*, OPENAPI_SPEC_FORMAT	now documented
OPENAPI_LOGFILE_PATH	removed (was never implemented)

🙏 Credits

SSL-skip groundwork by @robbycochran (#15), incorporated with original authorship preserved.

Full test suite: 135 passing.