From REST to MCP: An Empirical Study of API Wrapping and Automated Server Generation for LLM Agents

1. Problem Statement

Large Language Models (LLMs) are increasingly deployed as autonomous agents that rely on external tools to perform tasks. The Model Context Protocol (MCP) has emerged as a standard interface for these agents to invoke tools. However, a significant engineering bottleneck exists: constructing and maintaining MCP servers for the vast number of existing vendor services.

Most vendor services expose REST APIs (often documented via OpenAPI specifications), yet the relationship between these raw APIs and the curated MCP tools is poorly understood. Key challenges include:

• Lack of Empirical Data: It is unknown how many REST operations are exposed as MCP tools, which are omitted, and what mapping patterns developers use.
• Scalability Issues: LLM tool-selection accuracy degrades significantly as the number of available tools grows. A one-to-one mapping of REST endpoints to MCP tools often results in "tool-set explosion," overwhelming the agent.
• Automation Barriers: While OpenAPI specifications are machine-readable, they often contain defects (e.g., missing auth schemes, malformed URLs) that prevent reliable automated generation of MCP servers.

2. Methodology

The authors conducted a multi-stage empirical study involving 116 official MCP servers and 80 real-world OpenAPI specifications. The study is structured around four Research Questions (RQs):

• RQ1 (Architecture & Integration): Analyzed 116 servers to determine reliance on REST APIs, integration strategies (bare wrappers vs. custom logic), and configuration practices.
• RQ2 (Mapping & Exposure): Paired 42 servers with their OpenAPI specs to quantify operation exposure (coverage), omission patterns, and mapping structures (one-to-one vs. many-to-one).
• RQ3 (Generation Feasibility): Built AutoMCP-Baseline, a tool that generates MCP servers directly from OpenAPI specs. They evaluated this on 77 APIs (2,190 sampled tools) to measure success rates and identify failure root causes.
• RQ4 (Repair & Optimization): Developed AutoMCP, an enhanced pipeline integrating SpecFix (automated specification repair) and Tool-Set Transformations (filtering and grouping) to improve correctness and reduce complexity.

Data Collection & Analysis:

• Datasets: 116 servers from official registries; 42 paired with OpenAPI specs; an extended corpus of 80 APIs (42 from RQ2 + 38 stratified random samples).
• Analysis Techniques: Manual code tracing for REST reliance, LLM-assisted semantic alignment for tool-operation mapping, and execution-based testing using Claude as the MCP client.
• Intervention: A two-phase approach for RQ4: (1) Detecting and repairing specification defects using rule-based analysis and LLM validation; (2) Applying category-based filtering and deterministic grouping (e.g., Collection/Item Merge) to reduce tool count.

3. Key Contributions

1. First Large-Scale Empirical Study of MCP: The paper provides the first systematic characterization of how MCP servers are constructed, revealing that 88.6% are fully or partially REST-backed.
2. Discovery of Systematic Omission Patterns: The study identifies that MCP servers expose a median of only 19% of available REST operations. Developers systematically omit security-sensitive (auth, authz), administrative, and deprecated operations, while preferentially exposing retrieval and analytics operations.
3. Identification of Mapping Patterns: While 89.8% of tools are one-to-one mappings, the authors identified five recurring aggregation patterns (e.g., Collection/Item Merge, Lifecycle Action Bundle) used to group operations.
4. AutoMCP Framework: A novel end-to-end pipeline that:
   • SpecFix: Automatically detects and repairs specification defects (e.g., missing auth headers, relative URLs) by cross-referencing vendor documentation.
   • Transformations: Applies empirically grounded filtering and grouping to reduce tool-set size without losing critical functionality.
5. Defect Taxonomy: A classification of specification-level defects that cause generation failures, categorized into authentication misconfigurations, malformed URLs, undocumented headers, parameter mismatches, and missing endpoint auth.

4. Key Results

RQ1: REST Reliance & Integration

• 88.6% of servers rely on REST APIs.
• 92% of tools are "bare API wrappers" (direct pass-throughs). Only 8% involve custom logic (e.g., workflow orchestration, AI-mediated transformation).
• Configuration: Token-based auth (API keys, Bearer) dominates; STDIO is the primary transport mechanism.

RQ2: Exposure & Mapping

• Coverage: Median coverage is 19%. Coverage drops as API size increases (from 68% for small APIs to 6% for very large APIs).
• Omission: Security and configuration categories are omitted at rates >90%. Retrieval and analytics are preferentially exposed.
• Mapping: 89.8% of tools map 1:1 to operations. Aggregation (many-to-one) is rare but follows predictable patterns like merging collection and item endpoints.

RQ3: Generation Feasibility

• Baseline Success: AutoMCP-Baseline achieves a 76% tool execution success rate.
• Failure Causes: Failures are rarely due to the generator but rather specification defects (e.g., missing security schemes, relative URLs). These defects affect entire APIs rather than individual tools.
• Root Causes:
  • (A) Incorrect/Missing Security Schemes (416 tools affected).
  • (B) Malformed Base URLs (149 tools).
  • (C) Undocumented Runtime Headers (121 tools).

RQ4: Repair & Optimization

• SpecFix Impact: Automated repair raised the tool execution success rate from 76% to 94.2%.
• Tool-Set Reduction: Filtering and grouping reduced the total tool count by 23.9%, lowering the median tools per API from 73 to 49 (a 32.9% reduction).
• Scalability: The reduction pipeline is most effective for large APIs, bringing tool counts closer to the practical limits of current LLM agents.

5. Significance

• For Practitioners: The paper provides empirically grounded design heuristics for building MCP servers. Developers now know which operation categories to expose (retrieval, analytics) and which to suppress (auth, admin) to optimize agent performance.
• For API Providers: The defect taxonomy serves as a checklist to improve OpenAPI specifications, ensuring they are "automation-ready" and preventing silent failures in downstream agent workflows.
• For the Ecosystem: The release of AutoMCP demonstrates that high-fidelity, automated MCP server generation is feasible. By combining specification repair with intelligent tool-set reduction, the barrier to integrating new services into LLM agents is significantly lowered, addressing the "tool-selection bottleneck" that limits agent reliability.

In conclusion, the study bridges the gap between raw REST APIs and usable LLM tools, proving that with automated repair and strategic curation, the vast ecosystem of REST APIs can be efficiently and reliably exposed to autonomous agents.