Sourced*

Agents

Generate a Grok Bot connector from OpenAPI

· 2 min read · Sourced

  • openapi
  • grok
  • mcp
  • xai

If customers want Grok Bot to use your API, the clean path is not a custom one-off script. Start from OpenAPI, generate an MCP server, deploy it behind HTTPS, and give Grok a narrow remote MCP connector config.

That is the shape Sourced generates.

What Grok needs

A Grok connector needs three practical things:

  1. A public HTTPS MCP endpoint.
  2. A reviewed list of allowed tools.
  3. A way to pass MCP endpoint auth without putting API credentials into chat-visible tool arguments.

xAI's remote MCP setup supports a remote server URL, a label/description, tool allowlists, and auth/header fields. The safety lesson is simple: do not expose every OpenAPI operation just because the generator can see it.

Why OpenAPI helps

OpenAPI gives the generator enough information to create the first tool surface:

  • path and method
  • operation ID
  • parameters
  • request body schema
  • response notes
  • auth schemes
  • base URL

Sourced adds the missing agent layer. It classifies tools as read, sensitive read, write, or destructive. Then it uses only non-sensitive read tools as the default Grok allowlist.

The generated Grok files

The Sourced pack includes:

  • connector.grok.json
  • connector.grok.md
  • connector.grok.xai-sdk.py
  • connector.grok.openai-sdk.py
  • connector.grok.curl.sh
  • agent-readiness.md
  • harness tests that check the allowlist

The JSON file is intentionally reviewable. If the MCP endpoint is not deployed yet, the file says it is blocked. If the endpoint uses auth and has not been verified, it says what is missing. For non-OAuth auth models with a safe allowlist, a verified endpoint emits a ready config with a placeholder for MCP_SERVER_ACCESS_TOKEN instead of storing the real token in the ZIP or repo.

The setup flow in Sourced

Sourced keeps the Grok connector flow explicit and sequential:

  1. Upload openapi.yaml.
  2. Choose Grok.
  3. Review the safe default tool list.
  4. Download the pack, or create a private repo if GitHub creation is available for your account.
  5. Deploy the generated HTTP MCP server.
  6. Paste the public https://.../mcp URL back into Sourced.
  7. Add the MCP endpoint token if the API uses auth.
  8. Copy the Grok config or xAI SDK snippet.

The page shows the next available action from the current state. If there is no deployable pack yet, it offers a download or private GitHub repo. If the pack exists but there is no hosted endpoint, it asks for the public https://.../mcp URL. If the endpoint uses auth, it asks for the MCP endpoint token and verifies the handshake before showing ready Grok snippets.

What not to do

Do not open random PRs into xAI-owned repositories. Do not put customer API credentials into generated files. Do not use an empty allowlist as a shortcut. Do not enable destructive tools until a human owner has reviewed the side effects, audit logs, rate limits, and rollback behavior.

The win is not "AI can call everything." The win is "Grok can call the right small set of API tools, with a generated report proving why those tools were chosen."

Generate the Grok connector pack or read the Grok MCP server generator page.