Struct OpenApiProvider 

pub struct OpenApiProvider { /* private fields */ }

OpenAPI to MCP provider.

This provider parses OpenAPI specifications and converts them to MCP tools and resources that can be used with a TurboMCP server.

Security

The provider includes built-in SSRF protection that blocks requests to:

• Localhost and loopback addresses (127.0.0.0/8, ::1)
• Private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
• Link-local addresses (169.254.0.0/16) including cloud metadata endpoints
• Other reserved ranges

Requests have a default timeout of 30 seconds to prevent slowloris attacks.

Implementations

impl OpenApiProvider

pub fn from_spec(spec: OpenAPI) -> Self

Create a provider from a parsed OpenAPI specification.

If spec.servers is non-empty, base_url is initialized from spec.servers[0].url (with any default variables substituted in). Use Self::with_base_url to override. Server URLs that fail to parse as absolute leave base_url unset; with_base_url must then be called before any tool/resource invocation.

pub fn from_string(content: &str) -> Result<Self>

Create a provider from an OpenAPI specification string.

pub fn from_file(path: &Path) -> Result<Self>

Create a provider by loading from a file.

pub async fn from_url(url: &str) -> Result<Self>

Create a provider by fetching from a URL.

pub fn with_base_url(self, base_url: &str) -> Result<Self>

Set the base URL for API calls.

pub fn with_route_mapping(self, mapping: RouteMapping) -> Self

Set a custom route mapping configuration.

pub fn with_client(self, client: Client) -> Self

Set a custom HTTP client.

Warning

When using a custom client, ensure it has appropriate timeout settings. The default client uses a 30-second timeout.

pub fn with_auth_provider(self, provider: Arc<dyn AuthProvider>) -> Self

Install an AuthProvider that injects credentials matching each operation’s SecurityRequirements. Without this, operations on authenticated upstream APIs will fail with 401 unless the caller has installed equivalent auth via Self::with_client.

pub fn security_schemes(&self) -> &HashMap<String, SecurityScheme>

Get the spec’s security scheme definitions, keyed by scheme name. Reference entries are silently dropped (rare in practice).

pub fn with_timeout(self, timeout: Duration) -> Self

Set a custom request timeout.

This rebuilds the HTTP client with the new timeout. The default timeout is 30 seconds.

pub fn timeout(&self) -> Duration

Get the current request timeout.

pub fn title(&self) -> &str

Get the API title from the spec.

pub fn version(&self) -> &str

Get the API version from the spec.

pub fn operations(&self) -> &[ExtractedOperation]

Get all extracted operations.

pub fn tools(&self) -> impl Iterator<Item = &ExtractedOperation>

Get operations that map to MCP tools.

pub fn resources(&self) -> impl Iterator<Item = &ExtractedOperation>

Get operations that map to MCP resources.

pub fn into_handler(self) -> OpenApiHandler

Convert this provider into an McpHandler.

Trait Implementations

impl Debug for OpenApiProvider

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.