Mulder
Documentation

Public compiler and Worker APIs.

Generate descriptors, build faithful requests, add a Worker companion, or emit restricted static files.

API reference

generateTools

Code
generateTools(document: OpenApiDocument): GeneratedTool[]

Compiles explicitly enabled operations into deterministic descriptors. Unsupported enabled operations fail the build.

buildRequest

TypeScript
buildRequest(tool: GeneratedTool, input: Record<string, unknown>, origin: string): Request

Validates input and constructs the path, query, and optional JSON body described by the operation.

createWebMcpCompanion

TypeScript
createWebMcpCompanion(options: {
  document: OpenApiDocument;
  renderPage: () => Response | Promise<Response>;
  dispatch: (request: Request, tool: GeneratedTool) => Response | Promise<Response>;
  prepareWrite?: (request: Request, tool: GeneratedTool, input: Record<string, unknown>) => Response | Promise<Response>;
  basePath?: string;
  resultSelector?: string;
  maxInputBytes?: number;
}): WebMcpCompanion

Provides the page, manifest, bootstrap, and call routes. If any generated tool changes data, prepareWrite is required.

Routes

RoutePurpose
GET /__mulder/Return your page and add the bootstrap.
GET /__mulder/manifestList browser-visible tools.
GET /__mulder/bootstrap.jsRegister tools in a supported browser.
POST /__mulder/call/:nameValidate and route one call.

injectWebMcpBootstrap

TypeScript
injectWebMcpBootstrap(response: Response, bootstrapPath: string): Promise<Response>

generateStaticWebMcp

Code
generateStaticWebMcp(document: OpenApiDocument, options: {
  apiOrigin: string;
  maxResponseBytes?: number;
  resultSelector?: string;
}): { manifest: string; bootstrap: string }

Emits build-time files for a static site. It accepts public GET operations only, requires a credential-free HTTPS origin, omits browser credentials, rejects redirects, requires JSON, and bounds response size.

Supported OpenAPI subset

  • OpenAPI 3.1 with inline schemas.
  • Enabled GET operations with scalar path and query parameters.
  • Enabled POST operations with one application/json body.
  • Enabled DELETE operations without a body.
  • Bounded object and array schemas inside POST bodies.
  • String, boolean, integer, and number constraints.

POST and DELETE require both x-webmcp-enabled: true and x-webmcp-approval-required: true.

Rejected

  • PUT and PATCH.
  • Header and cookie parameters.
  • References, combined schemas, and undeclared object properties.
  • Unsupported URL styles, media types, and unmatched path templates.

Start typing to search.