openapi2mcp

The core function is code generation, transforming OpenAPI specifications into TypeScript files that define MCP server tools. The generated TypeScript code then uses an `httpClient` to make API calls based on the original OpenAPI definitions. The `openapi2mcp` generator itself appears to implement reasonable safeguards against code injection into the generated output, such as escaping quotes and newlines for descriptions (`comment` function) and sanitizing names for variable generation (`cleanup_string` function). However, the ultimate runtime security of the *generated MCP server* is highly dependent on the security of the input OpenAPI specification (e.g., preventing malicious URLs or content if derived from untrusted sources) and the robustness of the external `httpClient` library (not provided in full source for analysis) to handle potentially malformed or malicious API call parameters safely.