# @frontmcp/plugin-skilled-openapi

> Wrap your REST API as a **skilled MCP server** without rewriting any controllers.

This plugin lets a FrontMCP server consume **signed skill bundles** produced by an external pipeline (typically FrontMCP Cloud, from your customer's OpenAPI spec at CI time) and serve them as MCP **skills**. The MCP client only sees three meta-tools — `search_skill`, `load_skill`, `execute_action` — while the per-operation REST tools stay hidden behind the skill abstraction. This avoids the well-documented "tool overload" problem (Claude reliability degrades past ~20 tools, GPT Actions caps at 30, Cursor at 40) when wrapping a real-world API with hundreds of endpoints.

## How it works

```text
OpenAPI spec  --(SaaS analyzer, signs)-->  spec.yaml + overlay.yaml   (signed bundle)
                                                  │
                                                  ▼
                          FrontMCP server with @frontmcp/plugin-skilled-openapi
                                                  │
                                                  ▼
   tools/list  ->  [search_skill, load_skill, execute_action, ...]
   skills/*    ->  curated skills (each carrying instructions + actions[])
   execute_action -> ABAC -> input validate -> HTTP -> output validate -> result
```

## Standards alignment

- **OpenAPI Overlay 1.0/1.1** — bundle is a standard OpenAPI spec plus an Overlay layering `x-frontmcp-skill: <id>` annotations on operations. Customers can hand-author overlays in any OpenAPI tool.
- **SEP-2076** (Agent Skills as a First-Class MCP Primitive, working-group draft) — skills surface via the SDK's skills primitive when the MCP client supports it, falling back to meta-tool-only mode otherwise.
- **Anthropic Agent Skills format** — skill content is markdown with progressive disclosure.

## Security model (MUST-HAVE defaults)

- **Mandatory bundle signing** (RS256/Ed25519 JWT-of-hashes per OPA's bundle model). `requireSignature: true` is the default; opt-out only via explicit `dev: true`.
- **RFC 8707 Resource Indicators** enforced on every JWT (per the 2026-03-15 MCP authorization spec). Confused-deputy class attacks blocked at admission.
- **SSRF defenses** layered: URL string check → host allowlist → post-DNS-resolution IP blocklist (RFC 1918, link-local incl. AWS/GCP/Azure metadata, loopback, ULA) → DNS-rebinding pin → per-host concurrency cap → optional egress proxy.
- **Bundle data treated as adversarial** even after signature verify (CVE-2025-6514 lesson). WHATWG `URL` only, RFC 7230 header validation, no shell-out, no `eval`, strict JSON Schema with `additionalProperties: false`.
- **Five-gate authorization stack**: bundle signature → inbound JWT (RFC 8707) → per-skill ABAC → credential allowlist → outbound SSRF + circuit breaker.
- **Indirect prompt injection** mitigations: `execute_action` returns a structured envelope; output schema validation is mandatory; response size capped; optional sanitizer hook.

See the OWASP MCP Top 10 (2026) coverage table in the plan document for full mapping.

## Status

⚠️ Under active development for FrontMCP v1.2.0. The wire format and SaaS push API are subject to change while SEP-2076 firms up.
