Give any AI agent the tools it needs.
Discover APIs, generate MCP integrations, identify repeated workflows, and create optimized tools for AI agents. Every generated tool is evaluated and approved by a human before an agent sees it.
npm install -g https://github.com/devlomingo/toolsmith-mcp/releases/download/v0.1.0/toolsmith-mcp-0.1.0.tgz && toolsmith-mcp demoAgents shouldn't be limited to the tools someone already wrote.
If a service has an API description, an agent should be able to use it, safely. If an agent keeps doing the same five calls, the platform should notice and offer one better tool. toolsmith-mcp does both, behind one standard MCP endpoint that works with any client.
Three gaps between agents and the APIs they need
Missing integrations
Most APIs have no MCP server. Hand-writing one per API doesn't scale, and generated ones are rarely checked against the live API.
Chatty workflows
Agents fetch a customer, their orders, then items and payments per order, one round-trip and one model turn at a time.
Unsafe automation
Auto-generated tools with write access, credentials in logs, SSRF through a base URL: generation without guardrails is a liability.
From API description to approved, optimized tool
Import
OpenAPI 3.x, Swagger 2.0 or a plain endpoint list becomes typed MCP tools. Missing information is reported, never invented.
Verify
Every read operation is called with real values from examples or from other endpoints. Writes are never called.
Approve
A human reviews tools, findings and permissions. Write and destructive tools stay hidden until granted.
Observe
Calls are traced with keyed value fingerprints, not payloads, so data flow is visible without storing data.
Discover
Repeated, data-linked workflows are mined; loops and parallelizable steps are recognised.
Compose
A composite tool is proposed, checked to return exactly what the original calls return, then approved and tracked for real usage.
Dashed arrow: composite steps call back through the dispatcher, so they get the same validation, policy and tracing. Nothing generated runs as code: imported operations and composites are declarative data executed by fixed, tested code. Architecture in detail →
One command per API
Each operation becomes a tool with input and output schemas, auth from environment variables, timeouts, rate limits and safe retries. Live verification classifies every read tool: verified, wrong parameter value, schema mismatch, auth failure, and more, after ToolFactory.
$ toolsmith-mcp import ./shop.yaml --name shop --token-env SHOP_TOKEN ✓ Demo Shop API: 11 operations (8 read, 2 write, 1 destructive) ✓ live verification — 8/8 read operations verified ✓ live: getOrderItems — verified [values: orderId←listOrders.id] ! permission review — 2 write, 1 destructive stay hidden Review, then approve: toolsmith-mcp approve shop
{
"toolName": "flow__getUserOrdersDetails",
"steps": [
{ "id": "getUser", "args": { "userId": { "$ref": "input.userId" } } },
{ "id": "getOrders", "args": { "userId": { "$ref": "input.userId" } } },
{ "id": "getOrderItems", "forEach": "steps.getOrders.result[*]",
"args": { "orderId": { "$ref": "item.id" } } },
{ "id": "getPayments", "forEach": "steps.getOrders.result[*]",
"args": { "orderId": { "$ref": "item.id" } } }
]
}
Workflows agents repeat, as one call
The miner links calls by data flow, folds loops, treats independent reads as commutative and applies a majority rule from AWO. The plan above was discovered from traces, with no hand-written wiring. Independent steps run in parallel; failures give partial results.
Measured, not estimated
Generated by npm run benchmark on Apple M1 Pro, 10 cores · Node v22.13.1 · MCP SDK 2.4.0 · commit 085fb68. Client, gateway and a demo API on loopback; latency measured at the MCP client over Streamable HTTP. Synthetic setup, not production measurements.
| Demo API latency | Sequential agent (8 calls) | Best-case parallel client (8 calls) | Composite (1 call) |
|---|---|---|---|
| 0 ms | 8.3 ms | 4.7 ms | 2.1 ms |
| 10 ms | 118 ms | 35.1 ms | 30.8 ms |
| 25 ms | 247 ms | 68.5 ms | 63 ms |
| 50 ms | 452 ms | 124 ms | 117 ms |
Against a client that already parallelizes perfectly, this run measured the composite +6% to +12% faster, but an independent re-run measured it slightly slower at 25 ms, so treat the latency difference as noise. The real saving is 7 fewer MCP round-trips, which in a real agent are model turns this benchmark does not include. A strictly sequential 3-step chain gains 3%–7%. LLM tokens were not measured, and no token claim is made.
Under high traffic (100 concurrent agents)
The composite completed 476.1 workflows/s vs 236.6 for best-case parallel clients and 252.8 for sequential agents, at p95 340 ms vs 1155 ms and 512 ms, while the gateway handled 476 MCP requests/s instead of 2358. 275 of 1000 parallel-client runs failed with connection resets (the macOS accept queue is 128); the composite had 0. Successful runs only; one process on one machine.
Workflow discovery: mean F1 0.97 across conditions (first version: 0.84). Weakest case: colliding small ids (1..10) at precision 0.69. Throughput: 1918 calls/s at 100 concurrent clients (p95 72.44 ms). Full report, method and limitations →
Running in a minute
Node 22.13+. No database or service to set up. Or use the Docker image.
# install and try the full lifecycle npm install -g https://github.com/devlomingo/toolsmith-mcp/releases/download/v0.1.0/toolsmith-mcp-0.1.0.tgz toolsmith-mcp demo # your own API toolsmith-mcp init toolsmith-mcp import ./openapi.yaml --name shop toolsmith-mcp approve shop toolsmith-mcp start toolsmith-mcp client-config
Implemented in v0.1.0
Both MCP eras
2025-11-25 and 2026-07-28 over stdio and Streamable HTTP, through the official v2 SDK. Works with any client.
Server aggregation
Upstream MCP servers behind one endpoint, prefixed, traced and usable in composites.
Capability requests
Agents ask for what is missing. The answer: available, composable, needs approval, or unsupported.
Lifecycle & rollback
Versioned integrations and composites, human-only approval, disable, enable, rollback, audit log.
Usage tracking
Calls, round-trips saved, and how often agents still do the workflow by hand. Unused tools are flagged.
Dashboard
No build step. Approvals, traces, workflows, benchmarks. English and Arabic, with right-to-left layout.
More sources
OpenAPI, Swagger, Postman collections, GraphQL introspection, plain endpoint lists, and (optionally, via an LLM) free-text docs.
Large catalogs
Per-client allow-lists enforced on every call, a search listing mode, and a tool-search meta tool.
Transforms & constants
Composites can filter, sort and pick ("the latest order") with a fixed vocabulary, and bake in arguments that never change.
OAuth & telemetry
OAuth 2.0 client credentials for APIs; OpenTelemetry span export; opt-in in-client approval via MCP elicitation.
- Nothing generated runs as code
- SSRF guard: allow-list, connect-time private-address block, no redirects
- Secrets only from the environment, redacted everywhere
- Traces keep keyed hashes, never tool results
- Generated write and destructive tools hidden until granted
- Per-call approval for destructive actions, including those of connected MCP servers, bound to exact arguments and the calling client's token
- Approvals from the dashboard or an interactive terminal, never through MCP
- Composites can never exceed their steps' permissions, and writing composites need their own write grant
- Tool-poisoning text in specs blocks approval
- PostgreSQL storage for multi-node deployments
- The gateway as an OAuth 2.1 resource server
- gRPC sources
- Mining non-contiguous calls inside a workflow
Built in the open
MIT licensed. Issues, ideas and pull requests welcome. Read the contributing guide and code of conduct; report vulnerabilities privately per the security policy.