The original idea came from repeatedly seeing the same workflow whenever someone wanted to expose an existing API to Claude, Cursor, or another agent:
* Parse an OpenAPI spec
* Generate tools
* Handle auth
* Deploy an MCP server
* Maintain it forever
I initially thought tool generation was the hard part.
After talking with developers, it seems the bigger challenges are authentication, permissions, endpoint selection, and safely exposing production APIs to AI agents.
MCPForge takes an OpenAPI spec or Postman collection and creates a hosted MCP endpoint. Recently, I've been spending more time on auth injection, tool permissions, and preventing destructive endpoints from being exposed by default than on generation itself.
Still very early (launched this week), and I'm mostly looking for feedback from people using MCP in production.
What's interesting is that the hardest problem doesn't seem to be coding anymore. It's orchestration, approvals, and knowing when an agent should hand control back to a human.
request_human_decision feels like the key idea here. Most discussions focus on agent autonomy, but production systems usually need structured approval points.