Sourced*

Agents

How to generate a Grok Bot MCP server from OpenAPI

· 2 min read · Sourced

  • grok
  • mcp
  • openapi
  • codegen

A Grok Bot MCP server is the bridge between a model and your API. If your API already has OpenAPI, most of that bridge can be generated.

Sourced does not stop at "here is a server." It also explains what is safe, what is blocked, and what the owner has to approve before the endpoint is exposed to a remote agent.

Minimum viable Grok MCP server

At minimum, the server needs:

  • a tool list derived from OpenAPI operations
  • JSON Schema tool input descriptions
  • an HTTP client that calls the upstream API
  • auth environment variables
  • a stdio entrypoint for local MCP clients
  • an HTTP MCP endpoint for remote hosts
  • a health check
  • tests for auth, origin, protocol, and tool listing

That is table stakes. The user experience depends on the layer around it.

What makes the generated pack reviewable

Sourced generates files a maintainer can inspect:

  • src/tools.ts with the generated tools
  • src/http.ts with the remote MCP endpoint
  • adapter.ir.json with normalized operation metadata
  • adapter.manifest.json with host compatibility
  • agent-readiness.md with safety issues
  • connector.grok.json with the Grok config
  • harness.tests/ with local metadata and runtime checks

This keeps the review concrete. Instead of asking "is this safe for Grok?", the maintainer can inspect the exact default tools, the excluded tools, and the generated connector payload.

Hosted endpoint rules

Remote MCP hosts need a public HTTPS endpoint. Sourced blocks localhost, private IPs, reserved domains, and insecure authenticated HTTP base URLs before it marks the remote connector ready.

For authenticated APIs, Sourced expects the generated MCP endpoint to require its own access token. This token protects the MCP server itself. It is not the same thing as the upstream API key used by the server to call your API.

Sourced validates the URL, token, and MCP handshake before it shows a ready connector, so users do not copy a config before the endpoint can answer Grok.

Allowlist rules

For Grok, Sourced generates a conservative default allowlist:

  • include normal read operations
  • exclude sensitive read operations
  • exclude write operations unless explicitly approved
  • exclude destructive operations by default
  • review internal/admin endpoints before adding them to the first pass

If no safe read tools exist, the generated Grok config stays blocked until the owner chooses specific tools.

Current setup path

  1. Generate the pack from OpenAPI.
  2. Run npm install and npm test inside the generated folder.
  3. Deploy the HTTP MCP server behind HTTPS.
  4. Set upstream API auth in the deployment secret manager.
  5. Set MCP_SERVER_ACCESS_TOKEN if the endpoint needs protection.
  6. Verify the endpoint in Sourced.
  7. Copy the Grok connector config.

Sourced gives you the concrete self-hosted path: download the pack, create a private GitHub repo if GitHub creation is available for your account, deploy the HTTP MCP server, verify the public endpoint, then copy the Grok config. Managed MCP hosting is separate from this generator, so the page only marks Grok ready after you provide a real endpoint.

Try the Grok MCP generator.