How to create an MCP server from your REST API (with OAuth, scopes, and risk classes)

Description and use

<p>Every team I talk to wants the same thing right now: let Claude, Cursor, or an internal agent look up an order, check a customer, or open a ticket by calling the APIs they already have. And every security team asks the same question back: <em>what stops the model from calling the endpoint that deletes things?</em></p> <p>The Model Context Protocol (MCP) answers half of that. It gives AI clients a standard way to discover and call tools. The other half, deciding which tools exist, who can call them, and what a "dangerous" call looks like, is on you.</p> <p>This post shows how to create an MC

Problem

<p>Every team I talk to wants the same thing right now: let Claude, Cursor, or an internal agent look up an order, check a customer, or open a ticket by calling the APIs they already have. And every security team asks the same question back: <em>what stops the model from calling the endpoint that deletes things?</em></p> <p>The Model Context Protocol (MCP) answers half of that. It gives AI clients a standard way to discover and call tools. The other half, deciding which tools exist, who can call them, and what a "dangerous" call looks like, is on you.</p> <p>This post shows how to create an MC

Outcome

<p>Every team I talk to wants the same thing right now: let Claude, Cursor, or an internal agent look up an order, check a customer, or open a ticket by calling the APIs they already have. And every security team asks the same question back: <em>what stops the model from calling the endpoint that deletes things?</em></p> <p>The Model Context Protocol (MCP) answers half of that. It gives AI clients a standard way to discover and call tools. The other half, deciding which tools exist, who can call them, and what a "dangerous" call looks like, is on you.</p> <p>This post shows how to create an MC

Evidence

How to create an MCP server from your REST API (with OAuth, scopes, and risk classes)

Source