XBOSS

파일 다운로드

fourinsure__b1__resources__files__download

Read-only

REQUIRES prior fourinsure__session__login call with same account_link_id. Download a resource file. Files: the document the institution issued, unchanged, as Hancom Office (hwp) or PDF, listed in artifacts[] of the result with a download_url that works for 15 minutes; each file is kept for 7 days. If a link has expired, call xdata__job__result with the job_id from the result for fresh links. For an anonymous result, keep its private recovery_receipt and send it with the original job_id or pack_run_id to xdata__job__result. It grants access to that result only, until the original file retention expires. Do not publish it. Losing it cannot be repaired by signing up. The receipt also works if the client later signs in; it does not grant access to other results. Without a receipt, results require the original account and lane. For an authenticated call, generate and save request_idempotency_key before the first request. Reuse it with the same arguments only to recover that request after a lost response; use a new key for a new execution. Without it, calling again remains a new request. This optional key is not available to anonymous taste calls. Keep any provider-specific idempotency_key unchanged; it is a different field. 호출마다 토큰 1소진

Input Schema

Name	Required	Description
`atfl_id`	Yes	Attachment file ID
`dry_run`	No	Default true (dry-run): returns existence and file name only. Set false to receive the actual file in the result artifacts.
`atch_file_sn`	Yes	Attachment file sequence number
`account_link_id`	No	Account link ID (UUID v4). Optional — the server auto-resolves from your API key when omitted. Provide explicitly only when you have multiple certificates for the same provider. Each institution has a separate ID (Hometax != NHIS != NPS != FourInsure).
`request_idempotency_key`	No	Optional same-request recovery key for authenticated calls; see the tool description.

Schema Changelog

Changes observed during successful MCP inspections.

Changed1 schema field changedOct 30, 2026

addedInput schema / properties / request_idempotency_key

Added value: +{
+  "description": "Optional same-request recovery key for authenticated calls; see the tool description.",
+  "maxLength": 128,
+  "minLength": 1,
+  "pattern": "^[\\x20-\\x7E]+$",
+  "type": "string"
+}

Changed1 schema field changedOct 24, 2026

addedInput schema / properties / dry_run

Added value: +{
+  "description": "Default true (dry-run): returns existence and file name only. Set false to receive the actual file in the result artifacts.",
+  "type": "boolean"
+}

AddedOct 10, 2026

TDQS

A3.8/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With readOnlyHint=true and destructiveHint=false already provided, the description still adds substantial behavioral context: link validity for 15 minutes, file retention of 7 days, recovery receipt handling, idempotency key semantics, and token cost. It omits the critical default dry-run behavior, which determines whether an actual file is returned.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the authentication requirement and core download behavior, but it is long and mixes preconditions, file retention, recovery receipts, idempotency, and token cost in dense paragraphs. Every detail is relevant to some flow, but the overall structure could be tighter.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

It covers authentication, link expiry, file retention, and idempotency well. However, it never mentions that dry_run defaults to true and returns only existence and file name unless set to false. For a download tool, omitting this default behavior is a significant completeness gap that could cause an agent to invoke it without receiving the actual file.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the schema documents all five parameters. The description adds meaningful detail for request_idempotency_key and account_link_id beyond their schema text. It does not add meaning for dry_run, atfl_id, or atch_file_sn, but those are adequately covered by the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states a specific verb and resource: download a resource file, with details on formats (hwp/PDF), artifacts, and download URLs. It is clear what the tool does, but it does not explicitly distinguish this download tool from similar sibling download tools such as certificate history or forms attachments.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives a strong precondition (prior fourinsure__session__login with the same account_link_id) and an alternative for expired links (xdata__job__result). However, it does not explicitly state when to use this tool versus other download siblings, leaving that inference to the agent.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All XBOSS tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources

Need Help?