reShapr
Turn your existing APIs into AI-Native, governed, context-optimized MCP tools without rewriting a single service.
- Source repo
- reshaprio/reshapr
- Stars
- ★ 170
- Last updated
- 3d ago
- License
- Apache-2.0
- Primary language
- Java
- FA score
- 63/100 · Some gaps
At a glance
- How it runs
- Works with
- Universal · cross-platform
- Cost
- Free, no paid service needed
- Setup effort
- Medium · a few setup steps
- You'll need
- Typical use
- Backend teams with many existing REST APIs that want internal AI agents to call them safely without hand-writing an MCP server per service.
- Not a fit if
- Teams that cannot run containers or a server for their APIs
- Projects using protocols other than REST, GraphQL, or gRPC
- LLM integrations that do not use MCP clients
- Source review
- 63/100 · Some gaps
What does this agent do, and when should you use it?
reShapr is an open source runtime (repository reshaprio/reshapr, Apache-2.0) that automatically transforms existing REST, GraphQL, and gRPC services into LLM-friendly, discoverable MCP tools, eliminating the need for a bespoke MCP server per API. It targets the context-window problem in agent building: its Context Control filters and slims down payloads before they reach the model, cutting token waste. The project ships as an npm-distributed CLI (@reshapr/reshapr-cli), a Docker Compose-deployed control plane (local port 5555), and auto-generated MCP server endpoints (port 7777). Developers import an existing contract such as an OpenAPI file and get working MCP tools within minutes. The current development version is 1.0.1-SNAPSHOT, with the latest release at 1.0.0.
reShapr reads existing API contracts (e.g., OpenAPI files) and auto-transforms their endpoints into LLM-discoverable MCP tools. The typical flow: install the CLI via npm (npm install -g @reshapr/reshapr-cli), run reshapr run to spin up the local Docker Compose platform, connect to the control plane at http://localhost:5555 via reshapr login (default credentials admin/password), then use reshapr import with a contract file and --backendEndpoint pointing at the real backend. After import, the platform serves a fully functional MCP server at http://localhost:7777/mcp/.... While running, it applies context optimization to backend responses, filtering and slimming payloads before they reach the LLM (Context Control), across REST, GraphQL, and gRPC protocols.
- Backend teams with many existing REST APIs that want internal AI agents to call them safely without hand-writing an MCP server per service.
- Agent developers facing tight context windows who need large JSON responses compressed before sending them to an LLM.
- Organizations maintaining REST, GraphQL, and gRPC services simultaneously that want one uniform way to expose them to the AI tool ecosystem.
- Platform engineers who want to self-host a governed API-to-MCP gateway on their own infrastructure via Docker.
- Evaluators who want to try it first in the hosted sandbox at try.reshapr.io before deploying locally.
How do you install or deploy this agent?
Prerequisites: Node.js and Docker installed.
npm install -g @reshapr/reshapr-cliAlternatively, developers can follow the repository's install/README.md to run the docker-compose stack with :nightly development builds, or try it online first in the managed sandbox at try.reshapr.io.
How do you use this agent?
Start the local platform (downloads the compose file and starts containers):
reshapr runConnect to the control plane (default credentials admin/password):
reshapr login -s http://localhost:5555 -u admin -p passwordImport an OpenAPI file and point at the real backend:
reshapr import -u https://raw.githubusercontent.com/open-meteo/open-meteo/refs/heads/main/openapi/forecast.yml \
--backendEndpoint https://api.open-meteo.comYou then get an MCP server at http://localhost:7777/mcp/reshapr/open-meteo-weather-forecast-api-1-0-default, ready to connect from any MCP client.
What are this agent's strengths and limitations?
- Zero rewrite: importing an existing contract yields working MCP tools with no bespoke MCP server per API.
- Context Control filters and slims payloads before they hit the LLM, directly addressing context overload and token waste.
- Multi-protocol support (REST, GraphQL, gRPC) unified behind a governed control plane.
- Signed SBOMs and checksums, OpenSSF Scorecard, and SonarCloud quality metrics make the supply chain auditable.
- Local operation requires a Docker Compose stack and a control plane, not a lightweight single process.
- The default control-plane credentials are admin/password, so security hardening is needed before production use.
- Output targets the MCP client ecosystem; LLM integrations that don't use MCP cannot benefit directly.
- The project just reached 1.0.0 with a 1.0.1-SNAPSHOT development version, so APIs may still evolve.
How does this agent compare with similar options?
The README contrasts reShapr with the common practice of writing a bespoke MCP server per API ("no bespoke MCP server per API"), but does not name specific competitors.
Key facts side by side with the most closely related agents.
| Agent | Source review | Form / cost | Stars | Updated | Language | Full support on |
|---|---|---|---|---|---|---|
| reShapr This agent | 63 · Some gaps | CLIFree | ★ 170 | 3d ago | Java | — |
| Concord MCP | 67 · Some gaps | — | ★ 763 | today | TypeScript | Codex · Claude Code |
| AgentEvals Trace Evaluation | 68 · Some gaps | CLIFree | ★ 166 | 15d ago | Python | — |
| Fusio | 52 · Major gaps | Self-hosted serviceFree + model costs | ★ 2.1k | 2d ago | PHP | ChatGPT |
How does FollowAgents rate this agent?
Why each dimension lost points
CI workflows use least-privilege permissions, SHA-pinned third-party actions, npm ci --ignore-scripts, and SBOM+cosign signing, supporting least_privilege and dependency_security. CLI tests prove delete and key-rotation require --force/--yes confirmation, so user_confirmation scores. Deductions: README documents default control-plane credentials (admin/password) with no forced-change note; sensitive_data_handling lacks transport/storage detail despite an encryption-rotate command; rollback has no evidence at all (no downgrade/recovery docs). Source headers, full Apache-2.0 LICENSE, and upstream credits in SECURITY.md make source_attribution strong.
Tests show structured error messages ('Admin request failed (409 Conflict)...') and graceful not-logged-in exit ('You are not logged in' instead of a TypeError), so failure_messages is strong. self_consistency: README install/output examples match CLI command structure, but the Java/control-plane core source is not in this file set, so full consistency cannot be checked. dependency_availability depends on remote registries and downloading compose files at run time; CI verifies builds but there is no offline story.
README distinguishes online sandbox, end-user local, and developer paths (audience_and_scenarios 2); Node/Docker prerequisites are stated (environment_fit 2). Deductions: capability boundaries are essentially undocumented (API scale, filtering limits); trigger precision of generated MCP tools and filter behavior has no source evidence in this file set, only marketing-level description.
install_notes earns full marks: concrete commands and expected output for all three paths. license earns full marks: full Apache-2.0 text in repo. Deductions: known_limitations nearly absent (only the no-LTS note in SECURITY.md); versioning uses semver/SNAPSHOT conventions but no CHANGELOG appears in these files; information_architecture leans on external docs links with limited in-repo structure; examples limited to quick start, no FAQ; maintenance responsibility is described (security team, cadence) but publisher identity is unverified/unknown.
output_usability: CLI shows progress output, structured output options, and error exit codes (tests verify process.exitCode=1), scoring 2. marginal_value: 'Context Control' payload slimming and avoiding per-API bespoke MCP servers is a genuine differentiator, but asserted only in the README. cost_benefit is deducted: token-savings claims have no quantified, traceable data, and running requires a multi-container Docker stack.
fact_inference_separation is 2: README mixes facts with aspirational marketing but they remain distinguishable. claim_traceability is deducted: 'signed SBOM & checksums', SonarCloud metrics, LFX/Scorecard badges all point to external systems unverifiable from this file set, and 'seconds'-level transformation has no in-repo evidence. cross_source_corroboration is 1: CI config confirms signing/provenance flows exist, but test results and security ratings cannot be checked in a static review.
- Static review covers only README, LICENSE, SECURITY.md, CI workflows, and partial CLI tests; core Java control-plane/proxy source was not reviewed, so confidence is low.
- Default control-plane credentials are admin/password with no forced-change prompt observed; rotate them immediately after local deployment.
- The runtime forwards requests to third-party APIs and exposes ports 5555/7777 locally; assess network exposure before deploying.
- Rollback/downgrade paths are undocumented; back up configuration before upgrading.
- Performance and benefit claims in the README (token savings, seconds-level transformation) are marketing statements not verified by this review.
- reshapr run fetches compose files from a remote source — a supply-chain trust decision; verify signatures before use.