v1.0.1-beta.260914 - Portable binaries can install approved package extensions into the HAPI_HOME

MCP Server Registry Integration

Build Once. Deploy Everywhere. Discover Globally.
Self-host, deploy, and register MCP servers with confidence using HAPI CLI, Docker, or Cloudflare Workers.

Website · Docs · MCP Registry · Run MCP · HAPI CLI

---

HAPI MCP: Turn your API into AI tools

• The HAPI landing page now identifies the configured upstream API for
  headless deployments. It displays only a sanitized HTTP(S) origin/path and
  never query parameters, fragments, or credentials.
• Removed the experimental --opaque-oauth, HAPI_ENABLE_OPAQUE_OAUTH, and
  legacy callback/state token flow. Use the licensed HAPI OAuth broker for
  interactive OAuth integrations.

Enterprise extension host and Worker profiles

• Portable binaries can now install approved package extensions into the
  managed $HAPI_HOME/plugins store with hapi plugins install; loaded
  extensions are validated and shown as [managed].
• OAuth and license runtime registries are process-global across compatible
  package graphs, allowing a managed private extension to integrate with the
  compiled HAPI host.
• Enterprise Worker releases are profile-specific static bundles. Public OSS
  Workers remain enterprise-free; private OAuth Workers require a signed
  license token/public key, HAPI_OAUTH_BROKER_KEY, and production D1.

Arazzo plugin - HAPI Workflows support 🚀

• Added verified Authorization Server Metadata resolution through
  HAPI_OAUTH_<SCHEME>_AUTHORIZATION_SERVER_METADATA_URL,
  HAPI_OAUTH_AUTHORIZATION_SERVER_METADATA_URL, or x-hapi.security.
  HAPI preserves upstream issuer/DCR metadata when valid and retains its local
  well-known metadata as a startup-safe compatibility fallback.
• Removed the experimental --relaxed-auth / HAPI_RELAXED_AUTH bypass.
  Configured API key, bearer, and Basic credentials remain server-side and are
  automatically applied to MCP discovery and backend calls without being
  exposed to clients.
• Arazzo workflow tools now map x-readOnlyHint, x-destructiveHint,
  x-idempotentHint, and x-openWorldHint specification extensions to MCP
  ToolAnnotations. OpenAPI uses the same strict boolean parsing, including
  string "true" and "false" values.
• OpenAPI tools and Arazzo workflows now share the same per-process license
  quota enforcement. Finite per-minute quotas expose RateLimit-Limit,
  RateLimit-Remaining, and RateLimit-Reset on consumed MCP requests;
  exhausted minute quotas also expose Retry-After. The existing MCP
  -32029 error remains unchanged.
• Fixed Cloudflare Arazzo execution parity: Worker runtimes now explicitly use
  in-memory storage, workflow retries use a portable timer instead of Bun-only
  APIs, and declared backend API-key/bearer schemes can fall back to
  HAPI_API_KEY/HAPI_AUTHENTICATION Worker secrets. Added bun run dev:worker for local source-Worker validation.

v1.0.0-beta.0823 - v1 Core + Plugins OpenAPI and Arazzo

Turn your existing APIs into MCP-compatible tools instantly usable by AI
agents, CLI workflows, and automation systems, without rewriting a
line of backend logic.

CLI and core

• Local controllers resolve from the OpenAPI spec filename before a
  supplied project name, so hapi serve tacos --mcp loads
  $HAPI_HOME/src/tacos/Controller.ts instead of deriving a random name from
  the API title.
• Added support for reusable OpenAPI request bodies. A
  components.requestBodies reference is resolved for MCP tools and its
  component key becomes the explicit payload argument name.

Enhanced release process (from legacy, v0.X.Y)

• Added portable standalone binaries with the OpenAPI, Arazzo, Cloudflare,
  and OpenTelemetry plugins statically bundled.
• Added gated package publication and multi-architecture Docker release
  commands; the container persists state in /var/lib/hapi.
• --packages now resolves required internal runtime dependencies
  automatically. Add --with-binaries to include the CLI and compile a
  Docker-capable binary that embeds only the selected first-party plugins.

Arazzo plugin - HAPI Workflows support 🚀

• Added the dedicated @mcp-com-ai/plugin-arazzo package.
• Added canonical hapi arazzo serve|validate commands and the exact
  hapi workflows ... alias.
• Made top-level hapi serve transparently dispatch OpenAPI and Arazzo entry
  documents while preserving legacy OpenAPI project names and --openapi.
• Added the shared --specs document selector to OpenAPI, Arazzo/workflow,
  and top-level serve commands. It accepts local paths, file:/path: URLs,
  and HTTP(S) URLs; --openapi remains a compatibility alias.
• Added offline Arazzo 1.1 validation, multi-source OpenAPI resolution,
  sequential workflow execution, runtime expressions/criteria/actions, and
  MCP workflow tools with typed structured results.
• Added bounded source/operation requests and metadata-only correlated
  workflow lifecycle logging.

Initial support matrix

Supported:

• Arazzo 1.1.x, validated offline with the official 2026-04-15 schema;
• OpenAPI source descriptions and both qualified operationId and
  operationPath references;
• workflow and step parameters, reusable parameter/action components,
  request bodies and JSON Pointer payload replacements;
• sequential steps, explicit/implicit dependencies, step/workflow outputs;
• simple conditions, regex, RFC 9535 JSONPath, XPath, and JSON Pointer
  selectors;
• ordered success/failure actions, same-workflow goto, end, bounded
  retries, Retry-After, per-step timeouts, and a transition limit;
• one MCP tool per workflow with JSON Schema input validation and structured
  success/error results.

Rejected during preflight:

• AsyncAPI sources and channel steps;
• workflow invocation, cross-workflow dependencies, and cross-document
  workflow execution;
• missing/ambiguous operations, invalid pointers or components, duplicate
  identifiers, forward dependencies, and normalized tool-name collisions.

Preflight is atomic: all documents and plans compile before the MCP listener
is created. Logs contain correlation, workflow/step identifiers, attempts,
durations, coarse HTTP status, retry delays, and error codes, but not workflow
inputs, bodies, outputs, authorization/cookie headers, or URL query values.