Docs

Documentation

Everything you need to turn an OpenAPI spec into a hosted MCP server.

Overview

corelayer0 turns any OpenAPI spec into a hosted MCP server. Import your spec, pick which endpoints to expose, choose a mode, and get a ready-to-use MCP URL with a Bearer token — no infrastructure to manage.

Import

Paste or link a spec — OpenAPI 3.x or Swagger 2.0, JSON or YAML

Configure

Pick a mode, set auth, toggle endpoints

Connect

Give the MCP URL to any AI client

Quick start

Create your first project in 30 seconds

1
Click New project on the dashboard.
No project yet? Use Try with a sample API to see corelayer0 working end-to-end with a built-in library of 20 literary classics.
2
Import your spec (URL or paste).
OpenAPI 3.x and Swagger 2.0 — JSON or YAML. The target API base URL is auto-detected from the spec.
3
Confirm the target API base URL.
All outgoing calls are forwarded to this URL.
4
Choose a mode and authentication, then click Create project.
Your MCP server URL and Bearer token are shown immediately. Copy the token — it is displayed only once.
5
Add the MCP URL to your AI client.
Use the Connect to Claude button for a guided OAuth flow, or configure any MCP-compatible client manually.

Spec formats

OpenAPI 3.x

JSON · YAML

Target URL auto-detected from servers[].url.

Swagger 2.0

JSON · YAML

Target URL reconstructed from host + basePath + schemes.

Paste — JSON or YAML up to 5 MB. Parsed server-side, never sent to an LLM.

URL — provide a public HTTPS URL; the server fetches the spec at creation time. No browser size limit.

The spec is immutable after creation. Only the enabled state of each endpoint can be changed afterward.

Generate from docs

AI-assisted

No published OpenAPI spec? Point corelayer0 at the API's documentation pages and an LLM drafts one for you — nothing is saved until you review it.

1On the New project modal, switch to the Generate from docs tab.
2Paste up to 5 documentation URLs — the pages that describe the API's endpoints.
3The server fetches and reads the pages, then an LLM (OVH AI Endpoints, gpt-oss-120b) drafts an OpenAPI spec.
4Review and edit the generated spec like any pasted spec, then continue to create the project.

Hard caps regardless of tier: 5 doc URLs, 60,000 characters of extracted doc text, and 8,000 output tokens. The documentation pages are read server-side and never enter the LLM context used to answer end users later — only this one drafting step.

MCP modes

Classic

Exposes one MCP tool per enabled endpoint. The tool name is derived from the HTTP method and path (e.g. get_users_id).

Best for APIs with fewer than 20 endpoints. Each tool carries its own schema, so the LLM knows exactly what to call.

Code mode

Exposes exactly 2 fixed tools: search(code) and execute(code). The LLM writes JavaScript to explore the spec and call the API — the spec itself never enters the context window.

Best for large APIs. Fixed token cost of ~1,000 tokens regardless of spec size.

You can switch modes at any time from the project detail page. Existing MCP clients reconnect automatically — no new token required.

MCP authentication

Every MCP server is protected. Two token formats are accepted:

cl0_mcp_… — Legacy Bearer token

Generated once at project creation, shown only once. Only the hash is stored — if you lose it, rotate via the project page.

Use this token in any MCP client that supports a static Bearer header: Authorization: Bearer cl0_mcp_…

mcp_at_… — OAuth 2.1 access token

Issued via the built-in OAuth 2.1 Authorization Server (PKCE S256). Used automatically when connecting through Claude or any MCP client that supports OAuth discovery. Tokens rotate on each refresh.

Token rotation — use the Rotate token button on the project page to invalidate the current cl0_mcp_… token. Update all MCP clients immediately after.

API authentication

How corelayer0 authenticates outgoing calls to your target API.

No authentication

Public API — no credentials injected. Default for open specs.

Bearer token

Enter your API key once. Stored AES-256-GCM encrypted and injected automatically on every call. The MCP client never needs to know the key.

Default header: Authorization: Bearer {token}. Customizable via Advanced settings.

OAuth2 Client Credentials

Machine-to-machine flow. Provide a token URL, client ID and client secret; the server acquires, caches and proactively refreshes the access token, injecting it as a Bearer on every call.

Optional: scope, audience, and client auth method (Basic header or request body) under Advanced settings.

Managing endpoints

Endpoints are imported from your OpenAPI spec at project creation and are immutable afterward — only their enabled state can be changed.

Default state

Only GET endpoints are enabled at creation. Enable write endpoints (POST, PUT, PATCH, DELETE) manually after reviewing them.

Toggling

Use the toggle on each row, or Enable all / Disable all for bulk actions. Changes take effect immediately — no redeploy needed.

Filters

Filter by keyword (path or summary), HTTP method, and enabled/disabled status. Paginated at 25 endpoints per page.

Description

The project description is injected as ServerInfo.instructions in the MCP handshake. A good description improves how AI clients discover and use the connector.

Connect your client

The project page has a Connect your client card with a dedicated tab for each tool. Pick yours — every tab shows the exact command or config and whether it connects via guided OAuth or a static Bearer token.

Client	Auth	How
Claude / Claude Desktop	OAuth	Connect to Claude button → consent popup, then paste the MCP URL into Settings → Connectors.
Claude Code	OAuth	claude mcp add --transport http <name> <url> — triggers the OAuth flow automatically.
Cursor	Bearer	Add the JSON snippet to .cursor/mcp.json (project) or ~/.cursor/mcp.json (global).
VS Code	Bearer	code --add-mcp … one-liner, or .vscode/mcp.json.
Windsurf	Bearer	Add the snippet to ~/.codeium/windsurf/mcp_config.json.
ChatGPT	OAuth	Developer mode → custom connector → OAuth discovery.
Mistral (Le Chat)	OAuth	Generate credentials, then paste the client ID/secret into Mistral.
Other	Bearer	Any Streamable-HTTP client; bridge stdio-only clients with mcp-remote.

Bearer tabs use your cl0_mcp_… token, shown once at project creation. Copy and store it. If lost, rotate it from the project page — all clients using the old token will need to be updated.

Claude & OAuth flow

On the Claude tab, the Connect to Claude button opens a consent popup that authorizes Claude.ai to access your MCP server via OAuth 2.1 — the same flow ChatGPT and Claude Code use.

1Click Connect to Claude — a consent popup opens and pre-approves this project.
2In Claude, open Settings → Connectors → Add custom connector.
3Paste the MCP URL shown on the Claude tab and confirm.
4Claude can now call your API through the MCP server.

Active OAuth sessions are listed on the Claude tab. Use Disconnect all Claude sessions to revoke all active tokens at once.

Mistral credentials

On the Mistral tab, Le Chat connects through OAuth2 client credentials. Unlike Claude, Mistral requires a static client ID and client secretthat you generate once and paste into Mistral's integration settings.

1Open the Mistral tab on your project page and click Generate credentials.
2Copy the Client ID and Client Secret — the secret is shown only once.
3In Mistral, open your agent settings and expand Advanced OAuth2 settings.
4Paste the Client ID and Client Secret, then save.
5Mistral will redirect users to a consent page where they confirm access using the MCP Bearer token shown on the project page.

Client secret — only the hash is stored server-side. If you lose it, click Generate credentials again to create a new client. The old one remains valid until explicitly revoked.

Limits

Limit	Free tier
Projects	1
Endpoints per project	100
MCP calls per month	5,000 (resets on the 1st)
Spec size (paste)	5 MB

Approaching the monthly call limit? The usage bar on your project turns amber at 80 %. Contact us to discuss higher limits.