KaiOpenAPI servers
Turn any HTTP API with an OpenAPI document into tools.
An HTTP API described by an OpenAPI 3.x document can be added as a server with the OpenAPI transport. Each operation becomes a tool, and Kai makes the HTTP calls itself, so approvals, permissions, credentials and tool groups work exactly as for MCP servers.
Adding one
Add server, pick OpenAPI as the transport, then give Kai the document:
- Fetch it from a URL,
- paste it (JSON or YAML), or
- Upload a file (up to 5 MB).
Kai reads it and shows the API's title and version, how many operations it found, and which it left out and why.
The base URL (where the calls go) is filled in from the document's first server, resolved against where the document came from. Change it if the API lives elsewhere.
If the document's security schemes send headers (an API key header, or
Authorization: Bearer), Kai says so. Choose Headers authentication and
the header list fills in from the document.
What becomes a tool
| Operations | GET, PUT, POST, PATCH, DELETE and HEAD; up to 300. Deprecated operations are left out. |
| Tool names | The operationId in snake case (getPetById → get_pet_by_id), or the method and path. |
| Descriptions | The operation's summary and description, plus METHOD /path. |
| Arguments | One per path, query and header parameter, and body for a JSON or form request body. |
| Read or write | GET and HEAD are read tools; DELETE is marked destructive. |
Left out, with the reason shown: request bodies that aren't JSON or form data (file uploads, binary), and cookie parameters. Swagger 2.0 documents aren't accepted; convert them to OpenAPI 3 first.
Calls
Kai fills the path parameters, adds the query string and headers, sends the
body as JSON or form data, and adds the server's header values (which win over
any header the model sets). The model gets HTTP <status> and the response
body, cut at 100,000 characters. A status of 400 or more is reported as an
error, so the model can try again differently.
Calls follow the same rules as everything Kai fetches: no private addresses unless allowed, same-origin redirects only, 60 seconds at most.
Updating the document
Kai stores the operations, not the document. To pick up changes, edit the server and Replace the document; the tools update without signing anyone out or clearing saved values.
Authentication is None or Headers. MCP's OAuth discovery doesn't
apply to plain APIs; put a token in an Authorization header instead.