Astrail docs

Quickstart

Build your first hosted MCP endpoint and owned SDK bundle from a real API contract. You'll discover an OpenAPI spec, generate MCP tools, connect an agent, export package-ready SDKs, and keep future updates synced through PR automation.

Guides

Production docs for agent tools.

OpenAPI to MCPGeneratorGenerate a hosted MCP server from an OpenAPI, Swagger, Redoc, YAML, or JSON API contract.Website to MCPGeneratorTurn public pages and same-origin links into safe read tools for agents when a clean API is not available yet.Code Mode for large APIsRuntimeUse search_docs and no-eval execute so agents can work with large APIs without hundreds of tool definitions.SDK FactorySDKExport owned TypeScript, Python, CLI, docs, manifests, tests, and update workflows from a hosted MCP server.Runtime permissionsSecurityControl which generated tools can call upstream APIs, require auth, access networks, and return runtime evidence.MCP client setupReferenceConnect Astrail-hosted MCP endpoints to agents, editors, scripts, and internal runtimes over HTTP JSON-RPC.ChatGPT and OpenAI Agents MCP setupClientsUse Astrail-hosted MCP endpoints with ChatGPT, OpenAI Agents, and custom agent runtimes that need reviewed tools.Claude and Cursor MCP setupClientsConnect Astrail-hosted MCP servers to Claude, Cursor, editors, and local developer workflows.Agent readiness scoreEvaluationEvaluate whether an API, website, or workflow is ready to become reliable agent tooling.MCP vs API vs SDKStrategyUnderstand when agents should use MCP, when developers should call APIs directly, and when teams should export SDKs.Secure agent tool deploymentSecurityShip MCP tools with auth, permission checks, network limits, logging, and review gates before agents call production systems.OpenAPI spec quality checklistOpenAPIImprove OpenAPI specs before generating MCP tools, SDKs, docs, endpoint maps, and agent-readable schemas.Website crawler safetySecurityUse website-to-MCP without giving agents unrestricted browser access or unsafe network reach.MCP observabilityOperationsTrace hosted MCP calls with execution modes, latency, upstream status, structured denials, and redacted runtime logs.Internal API to MCPEnterpriseTurn private internal APIs into reviewed MCP tools for support, operations, sales engineering, and internal agents.MCP marketplace templatesMarketplaceUse curated MCP templates for common apps, presets, and repeatable agent workflows before building custom servers.Answer engine optimization for agent toolsSEOMake MCP, API, SDK, and agent-tool documentation easier for search engines and AI answer systems to understand.CRM API to MCPExamplesTurn account, contact, deal, and activity APIs into MCP tools an agent can use without guessing raw CRM routes.Ticketing API to MCPExamplesExpose support tickets, comments, status changes, and escalation workflows as safe MCP tools for customer support agents.Payments API to MCPExamplesWrap payment customers, invoices, subscriptions, refunds, and dispute endpoints as auditable MCP tools.Calendar API to MCPExamplesConvert availability, event search, scheduling, and RSVP APIs into MCP tools for assistant-style agents.Analytics API to MCPExamplesExpose metrics, funnels, cohorts, dashboards, and event queries as MCP tools that return bounded analysis-ready data.Database API to MCPExamplesWrap database read APIs, admin queries, and approved mutations as MCP tools without handing agents raw database access.Ecommerce API to MCPExamplesGenerate MCP tools for products, inventory, orders, customers, fulfillment, and refunds while keeping store operations safe.Internal admin API to MCPExamplesExpose internal admin workflows as MCP tools with tight permissions, audit logs, and safe operational defaults.

Use cases

Where teams apply MCP.

Choose how your agent connects

OpenAI AgentsUse Astrail-hosted MCP or generated native tool adapters from the same endpoint.
Claude DesktopConnect the hosted HTTP endpoint through your MCP client config.
CursorUse tools/list, tools/call, search_docs, and execute from your editor agent.
Owned SDKExport package-ready clients, docs, tests, CLI, and update workflow.

If your agent supports hosted MCP, connect directly to the generated HTTP endpoint. If your team needs owned client code, export the SDK bundle from the same server.

Hosted MCPSDK FactoryNo-eval Code Mode
1

Install

Terminal
npm install @modelcontextprotocol/sdk zod

# Optional: pull an owned SDK bundle from Astrail
ASTRAIL_SDK_BUNDLE_URL=https://your-domain.com/api/servers/SERVER_ID/sdk \
ASTRAIL_SDK_OUT_DIR=./generated-sdk \
npm run sdk:pull
2

Generate endpoint

Send Astrail a real OpenAPI URL or docs page. Astrail discovers the schema, creates endpoint maps, chooses the right tool mode, and stores a hosted MCP server.

OpenAPI to MCP

Swagger UI pages, Redoc pages, YAML, JSON, and docs URLs are normalized into hosted tool metadata.

Website to MCP

Public pages become safe read/search tools with blocked private-network targets and bounded crawl limits.

cURL
curl -sS -X POST https://your-domain.com/api/generate \
  -H "Content-Type: application/json" \
  -d '{
    "source_type": "openapi_url",
    "source_url": "https://petstore.swagger.io/v2/swagger.json",
    "generation_mode": "code"
  }'
3

Connect an MCP client

Hosted endpoints expose HTTP JSON-RPC. Start with initialize and tools/list, then call tools through tools/call.

cURL tools/list
curl -sS -X POST https://your-domain.com/api/mcp/SERVER_ID \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $ASTRAIL_API_KEY" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}'

Code Mode

Two tools for large APIs: search_docs and execute.

Large APIs should not flood agent context with hundreds of tools. Code Mode exposes docs search plus no-eval execution. Agents search for the SDK-shaped method, then submit a constrained TypeScript snippet that Astrail compiles to endpoint-map execution.

cURL execute
curl -sS -X POST https://your-domain.com/api/mcp/SERVER_ID \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc": "2.0",
    "id": 2,
    "method": "tools/call",
    "params": {
      "name": "execute",
      "arguments": {
        "code": "async function run(client) { return await client.pets.list({ limit: 10 }); }",
        "result_mode": "compact"
      }
    }
  }'

SDK Factory

Export owned SDKs and docs from the same endpoint.

The hosted MCP endpoint stays the source of truth. SDK exports wrap it with typed clients, docs, manifests, CLI commands, package scaffolds, smoke tests, and GitHub workflows.

Pull SDK bundle
ASTRAIL_SDK_BUNDLE_URL=https://your-domain.com/api/servers/SERVER_ID/sdk \
ASTRAIL_SDK_OUT_DIR=./petstore-sdk \
npm run sdk:pull

cd petstore-sdk
node scripts/verify-generated-sdk.mjs

cd typescript
npm install
ASTRAIL_MCP_ENDPOINT=https://your-domain.com/api/mcp/SERVER_ID npm test
TypeScript client
import { AstrailClient } from "@astrail/petstore";

const client = new AstrailClient({
  endpoint: process.env.ASTRAIL_MCP_ENDPOINT!,
  apiKey: process.env.ASTRAIL_API_KEY,
});

await client.initialize();
const docs = await client.searchDocs("list available pets");
const result = await client.execute({
  code: "async function run(client) { return await client.pets.list({ limit: 10 }); }",
});
Python client
from astrail_petstore import AstrailClient

client = AstrailClient(
    endpoint="https://your-domain.com/api/mcp/SERVER_ID",
    api_key="ASTRAIL_API_KEY",
)

client.initialize()
docs = client.search_docs("list available pets")
result = client.execute(
    "async function run(client) { return await client.pets.list({ limit: 10 }); }"
)

Generated files

What every SDK bundle contains.

astrail.yaml

Generation config for targets, package names, auth, method hooks, and update automation.

typescript/

Typed package scaffold with MCP JSON-RPC client, endpoint helpers, tests, and examples.

python/

Python package scaffold with pyproject, endpoint helpers, examples, and smoke tests.

go/, java/, kotlin/

Compiled client targets for backend teams and JVM/Go deploy surfaces.

ruby/, csharp/, php/

Additional package targets for existing customer ecosystems.

cli/bin/astrail.mjs

Command wrapper for initialize, tools/list, tools/call, search-docs, and execute.

docs/REFERENCE.md

Endpoint reference with SDK method, route, auth, parameters, and runtime behavior.

docs/MCP.md

MCP client setup for Claude, Cursor, local scripts, and hosted HTTP JSON-RPC.

docs/STAINLESS_PARITY.md

Evidence report mapping generated files to production SDK expectations.

mcp/manifest.json

Machine-readable agent metadata for transport, tools, auth, capabilities, and endpoint map.

openapi/endpoint-catalog.json

Normalized endpoint catalog for review, diffing, docs, and custom tooling.

.github/workflows/astrail-update.yml

CI workflow that pulls, verifies, tests, and opens SDK update PRs.

Runtime proof

Production behavior is visible, not implied.

No eval for Code Mode execute. Astrail parses supported SDK-shaped calls and routes them through endpoint maps.
Auth-required endpoints return explicit auth_required states until credentials are attached.
Every call can record trace id, latency, upstream status, execution mode, and structured errors.
Public/private endpoint policy is enforced at the HTTP MCP boundary.

Automate updates

Regenerate SDKs through pull requests.

The generated GitHub workflow pulls the latest Astrail bundle, verifies required docs and manifests, runs smoke tests against the hosted MCP endpoint, compiles SDK targets, and opens a review PR.

Publish

Package-manager release stays opt-in.

Review astrail.yaml, connect registry credentials in CI, then publish to npm, PyPI, Maven, RubyGems, NuGet, Packagist, Go modules, or internal registries.

Glossary

MCP reference terms and FAQs.

CoreToolLearn what an MCP tool is, how tools/list exposes tool schemas, and how Astrail turns API operations into safe hosted MCP tools.CoreResourceUnderstand MCP resources, resource URIs, when to use resources instead of tools, and how hosted MCP servers expose contextual data.CorePromptLearn what MCP prompts are, how they package reusable workflows, and when to use prompts with generated MCP tools.ProtocolJSON-RPCA practical explanation of how MCP uses JSON-RPC 2.0 for initialize, tools/list, tools/call, errors, and hosted HTTP endpoints.Protocoltools/listLearn how tools/list lets MCP clients discover available tools, schemas, descriptions, and safe invocation metadata.Protocoltools/callUnderstand MCP tools/call, including argument validation, tool routing, structured results, and hosted runtime safeguards.ProtocolSchemaLearn how MCP schemas describe tool inputs and structured outputs, and why schema validation matters for generated MCP endpoints.RuntimeEndpoint mapA practical guide to endpoint maps, the routing layer that connects MCP tool names to upstream API operations and SDK methods.RuntimeHosted MCP endpointLearn what a hosted MCP endpoint is, how HTTP JSON-RPC works, and how Astrail secures generated MCP servers for agents.PackagingMCPBUnderstand MCPB, the MCP Bundle format for packaging local MCP servers with a manifest for one-click installation.ProtocolstdioLearn how MCP stdio transport works, when local MCP servers use stdin/stdout, and how it compares with hosted HTTP endpoints.ProtocolSSE/HTTPUnderstand MCP Streamable HTTP, SSE response streams, POST requests, GET streams, and hosted MCP endpoint behavior.SecurityAuth scopesLearn how OAuth scopes, API keys, public tools, and private hosted MCP endpoints shape authorization for tool discovery and invocation.SecurityRate limitUnderstand MCP rate limits for hosted endpoints, abuse protection, per-route buckets, global spray limits, and Retry-After behavior.SecuritySSRFLearn what SSRF means for hosted MCP tools, website-to-MCP generation, private network blocking, and safe URL handling.

Reference

HTTP API surface.

POST/api/spec-preview

Inspect a docs URL or spec before generation.

POST/api/generate

Create a hosted MCP server from OpenAPI, Swagger, Redoc, or raw JSON/YAML.

POST/api/website-to-mcp

Create public website-read MCP tools from a URL.

POST/api/mcp/:serverId

Call initialize, tools/list, tools/call, search_docs, and execute.

GET/api/servers/:id/sdk

Export owned SDK bundle, docs, CLI, tests, manifests, and workflows.

GET/api/servers/:id/worker

Export a Worker-ready MCP runtime bundle.

POST/api/credentials

Attach provider credentials for auth-required upstream APIs.

Auth

Protect private endpoints with Astrail API keys.

Public servers can be called without a bearer token. Private servers require Authorization: Bearer ASTRAIL_API_KEY. Upstream provider credentials are attached separately through the credentials API or dashboard.

Limits

Default safety boundaries.

Payloads

Bounded request and response sizes for hosted tools/call.

Execution

No arbitrary eval for Code Mode execute.

Network

Website-to-MCP blocks local/private network targets.

Troubleshooting

Fix common MCP and SDK errors.

Use these runbooks when an endpoint reaches the client but auth, schemas, tool discovery, CORS, limits, or generated SDK builds fail.

View all troubleshooting guides

Next steps