TIL: Two tools are enough to turn any SaaS API into an MCP
One of my clients runs on a handful of SaaS subscriptions, and none of them have native MCP support. I wanted ClickUp Brain, Claude and similar apps to work with those tools directly: pull data, hit endpoints, get things done without me in the middle.
The problem: one tool per endpoint
My first attempt was the obvious one. I built my own MCP server and wrote a tool for each API endpoint. It worked, but it wasn't efficient. Every endpoint meant another tool to write.
Then I noticed Cloudflare's own MCP server gets by with only three tools. So I asked myself how, and that's when I started digging.
What I learned: two tools are enough
You don't need a tool per endpoint. You need two:
- Search docs. I pulled the schema JSON out of the SaaS's API documentation. The agent searches it to find the endpoint it needs and the parameters it takes.
- Code mode. One tool that runs code through Cloudflare's code mode. The agent writes a small API script, and Cloudflare runs the calls.
Say I ask for the routes assigned to every technician. The agent searches the docs for the right endpoints, writes a script that calls them, and code mode runs it. The script also arranges the data before it comes back, so what I get is the answer, not a pile of raw responses.
For auth: if the app supports OAuth, use that. If it doesn't, use an API key and put it in the Worker's secrets. Either way, the key stays on the server.
Why it works
If a SaaS has API documentation, you already have most of an MCP server. The docs say what's possible, and one code-running tool makes it happen. The same two tools work for any documented API, not only the ones that ship their own MCP server.
It also changes where credentials live. If you want Claude to call an API directly, you have to set up a local env file with the keys on your machine. Put the same thing behind an MCP server and the token is already taken care of.
The catch is that the MCP link itself becomes the thing to protect. Don't share it on the internet, because anyone who has it can use your keys. Ours sits behind our app's authentication layer, so no one else can use it.
I got here by trial and error. If you're stuck on a SaaS that "has no MCP support," try search docs plus code mode before writing a tool per endpoint.
