OpenAPI to MCP Changelog

Released changes to the OpenAPI to MCP plugin (`openapi-to-mcp`), newest release first.

16 released changes name openapi-to-mcp, newest release first — 16 in API7 Gateway. Each row links to the change itself.

API7 Gateway

Release	Date	Type	Change
3.9.13 (opens in API7 Gateway docs)	2026-05-22	Feature	Added allowed_hosts to restrict which hosts a dynamically resolved base_url may target. When allowed_hosts is not configured, existing behavior is unchanged. The plugin also rejects malformed resolved URLs and non-HTT… (opens in API7 Gateway docs)
3.9.9 (opens in API7 Gateway docs)	2026-04-10	Fix	Fixed issue: The Data Plane compatibility report showed spurious warnings for valid plugin configurations. Plugins using patternProperties, conditional schemas (if/then/else), allOf, dependencies, or additionalPropert… (opens in API7 Gateway docs)
3.9.8 (opens in API7 Gateway docs)	2026-04-07	Feature	Added a new plugin for per-tool access control on MCP services exposed via the OpenAPI-to-MCP plugin. Supports allowlist (allow_tools) and denylist (deny_tools) modes with expression-based matching conditions for rout… (opens in API7 Gateway docs)
3.9.8 (opens in API7 Gateway docs)	2026-04-07	Feature	Added support for OpenAPI in: header parameters. Header parameters defined in OpenAPI specs are now correctly included in MCP tool schemas and forwarded as HTTP headers when invoking the upstream API. (opens in API7 Gateway docs)
3.9.7 (opens in API7 Gateway docs)	2026-03-25	Feature	Added MCP Tool Annotations support. Tools generated from OpenAPI specs can now carry behavioral metadata (read-only, destructive, idempotent) via the x-mcp-annotations vendor extension, enabling AI agents to better un… (opens in API7 Gateway docs)
3.9.0 (opens in API7 Gateway docs)	2026-01-06	Fix	Fixed issue: Passing authentication credentials via query parameters could lead to sensitive information leakage. (opens in API7 Gateway docs)
3.8.21 (opens in API7 Gateway docs)	2025-12-23	Fix	Fixed issue: Errors or perpetual loading occurred when configuring the MCP Server in AI clients such as Cursor and Cline. (opens in API7 Gateway docs)
3.8.21 (opens in API7 Gateway docs)	2025-12-23	Feature	Provided the flatten_parameters parameter to control whether path and query parameters from the OpenAPI specification are placed at the top level of the tools input schema. (opens in API7 Gateway docs)
3.8.20 (opens in API7 Gateway docs)	2025-12-11	Fix	Fixed issue: Variables in base_url were not resolved correctly. (opens in API7 Gateway docs)
3.8.19 (opens in API7 Gateway docs)	2025-12-09	Feature	Supported using variable syntax in base_url. (opens in API7 Gateway docs)
3.8.17 (opens in API7 Gateway docs)	2025-11-10	Feature	Considered the default values of query parameters defined in OpenAPI when sending requests to the upstream service. (opens in API7 Gateway docs)
3.8.16 (opens in API7 Gateway docs)	2025-10-28	Fix	Fixed issue: A 500 status code was thrown when the headers field was not configured. (opens in API7 Gateway docs)
3.8.16 (opens in API7 Gateway docs)	2025-10-28	Fix	Fixed issue: MCP tool names were generated from the OpenAPI paths, which could exceed the length limit for tool names. Now MCP tool names are generated from OpenAPI operation IDs. (opens in API7 Gateway docs)
3.8.16 (opens in API7 Gateway docs)	2025-10-28	Fix	Fixed issue: SSE mode does not work when path_prefix and strip_path_prefix were both configured in the service. (opens in API7 Gateway docs)
3.8.15 (opens in API7 Gateway docs)	2025-10-13	Feature	Supported streamable HTTP as a transport method for MCP. (opens in API7 Gateway docs)
3.8.13 (opens in API7 Gateway docs)	2025-09-23	Feature	Introduced new plugin. (opens in API7 Gateway docs)