npx mcpblaze · no signup · takes a minute

The instantly more secure MCP

Regular MCP generators don't secure anything: every user of the agent can take any action your backend allows. MCPblaze turns your OpenAPI spec into an MCP where users sign in and each one can only do what they should be able to do. All in one command.

terminal — one command: an MCP, sign-in, and who-can-do-what rules
$ npx mcpblaze create --target https://ninopizzas.com/openapi.yaml
? How should callers sign in? Sign in with an account (OAuth)
? Which sign-in? Hosted sign-in with GitHub
? Do you want to prevent unauthorized users from taking unauthorized actions? Yes
Reading your OpenAPI spec…
? Lock these to the person who created them (or an admin):
Only the person who created a reservation — or an admin — can view, change or delete it.
grants on POST /reservations · checks on GET, PUT, DELETE /reservations/{reservationId}
Only the person who created an order — or an admin — can view or change it.
grants on POST /orders · checks on GET, PATCH /orders/{orderId}
reviews — not protectable: the reply to POST /reviews has no id we can record
space toggles · a all · enter accept
? Who is the admin? Their email address: julien@ninopizzas.com
Proxy created!
https://nino.abz.run/1.0.0/dev — callers sign in with GitHub
reservations + orders locked to their creator (1 skipped)
julien@ninopizzas.com added as admin — active on first sign-in
Connect your agent: https://nino.mcp.abz.run/1.0.0/dev

This is the real transcript. The rules come from the shape of your spec — no AI guessing — and you read each one as a plain sentence before it turns on.

The problem

Regular MCP generators don't secure anything

They make it possible for an agent to act on your API. They do nothing about who is allowed to do what. Here is why that is worse than it sounds.

1

One shared key for everyone

A generated MCP server connects to your backend with a single credential. Every tool call — from every user of the agent — arrives as that one key.

2

Your backend can't tell users apart

It sees "the MCP", never the person. It has no way to know that this request is Alice asking about her own reservation and that one is Bob asking about hers.

3

So every user can do everything

Anything your backend allows the key to do, any user of the agent can do — to any record. The agent working for Alice can cancel Bob's reservation, and nothing stops it.

Fixing it yourself is three projects: a sign-in flow for the MCP, a way to carry the signed-in person to your backend on every call, and per-record rules that check it. Most teams ship the MCP and never get to the other two.

What MCPblaze does

One command. Three things that normally take three projects.

MCPblaze is powered by the APIblaze serverless proxy, which already knows how to sign users in and enforce who may touch which record. Point it at your spec and all three come out together.

1/3

Your API becomes an MCP

Every route in your OpenAPI spec becomes a tool at a URL any MCP client can connect to — Claude, ChatGPT, or your own agent.

https://nino.mcp.abz.run/1.0.0/dev
2/3

Users sign in

The client runs the standard MCP sign-in flow (GitHub by default). Every tool call now carries a real, verified person — not a shared key.

this call is Alice — verified
3/3

Each user can only touch what is theirs

Rules read from your spec: whoever created a reservation is the only one who can see, change or cancel it. Admins can act on anything. You see the rules and approve them before they turn on.

reservation 42 → owner: Alice · admins: yes · everyone else: no
Alice, Bob, and the agent

Connect Claude or ChatGPT and try it

The client opens nino.mcp.abz.run, asks Alice to sign in with GitHub, and from then on every tool call is Alice — not “the MCP”.

When she is not allowed, the agent gets a clear “not allowed” it can explain — not an empty answer it has to guess about.

The agent, working for Alice, tries to…Result
Book a tableAllowedreservation 42 is recorded as Alice's
Read reservation 42Allowedit is hers
Change or cancel reservation 42Allowed
Read or cancel Bob's reservation 43Not allowedthe agent is told plainly it is not allowed
The same, once Alice is made an adminAllowedadmins can act on anything
Where the rules come from

Your spec, read literally

  • A route that creates something (POST /reservations) tells us who the owner is.
  • Routes that touch one thing by id (GET, PUT, DELETE /reservations/{id}) get the rule: owner or admin only.
  • No AI decides your security. The same spec always produces the same rules, and each is shown as a sentence you approve first.
  • Nothing changes in your backend. The rules are enforced in front of it.
What stays open — we say so

Rules protect one record at a time

These stay reachable by any signed-in user, and the command tells you:

  • GET /reservationsthe list. Add a rule for it with npx apiblaze rule nino if a list of everything is too much.
  • POST /reservationscreating is how we learn who owns what.
  • POST /searchaction-style routes that do not touch one record by id.
  • older recordsanything created before the rules went on has no known owner — only admins can touch it.

Try it on your own spec

No account needed. It takes about a minute, and you approve every rule before it turns on.

$ npx mcpblaze create --target https://your-api.com/openapi.yaml