There are now several tools that take an OpenAPI spec and emit a working MCP server. They are genuinely good, and if you are wiring an assistant to an API you personally control, you should use one. This article is about the point where they stop being the right answer, which arrives sooner than most teams expect.
What a generator gives you
A generator reads your spec and produces one MCP tool per operation, with input schemas derived from the parameters. That is the mechanical part of the problem, and it is largely solved. If your goal is to let yourself query your own staging API from an assistant, you are done.
The assumption underneath
A generated server assumes there is exactly one caller and one set of credentials. The API key lives in the server's configuration, and every request the server makes uses it. That assumption is invisible while you are the only user, and it is the thing that breaks first.
The moment a second person uses the assistant, the server cannot distinguish them. Both get the permissions of whatever credential is in the config. If one of them should not be able to issue refunds, nothing stops them. The model may have been told not to, but the server will still execute the call.
What has to be true instead
- The caller must be identified. Not the integration, but the person.
- Authorisation must be checked where the call is executed, not suggested to the model in a prompt.
- Credentials must never leave the server. If a client config holds your API key, that key has left your control.
- Every call must be recorded against the identity that caused it, including the calls that were refused.
- Customers must be isolated from each other by the system, not by every query remembering to filter.
Why this is not a feature you add later
Each of those is an architectural property rather than a feature. Identity has to be threaded through from the transport to the query layer; retrofitting it means touching every call path. Isolation enforced in the database is a different design from isolation enforced by convention. Teams that start with a generator and add governance later usually end up rewriting the server.
The honest summary
Use a generator for your own tools, internal spikes, and anything single-user. Once an API is reachable by people whose permissions differ (your customers, or your own staff in different roles), the generated server is not a smaller version of what you need. It is a different thing.