Skip to main content
Glama

Servidor MCP de OnePlatform

Conecta un agente de código a la documentación de OnePlatform y a la OnePlatform API con sus propias claves, en QA por defecto.

Herramientas

Grupo

Herramientas

Claves

Documentación

docs_search, docs_get_page, api_get_operation

No

Lectura

perfil, historial de saldo, consumo, comercios, links de pago, transacciones, facturas, envíos, sitios y avisos

Sí

Escritura sin dinero

createPaymentLink (sin customer_email) y cancelPaymentLink

Sí

La lista exacta está en tools.manifest.json y lo que nunca puede exponerse, en denylist.json: administración, credenciales, webhooks y toda operación que cobre saldo, emita documentos fiscales o mueva dinero.

Related MCP server: switch-trust-mcp

Uso local (stdio)

ONEPLATFORM_APP_KEY=ak-XXXX… ONEPLATFORM_USER_KEY=sk-XXXX… npx -y @oneplatformlabs/mcp

Variable

Valor

ONEPLATFORM_APP_KEY

Clave de aplicación (ak-…). Opcional: sin claves sólo están las herramientas de documentación

ONEPLATFORM_USER_KEY

Clave de usuario (sk-…)

ONEPLATFORM_ENV

qa (por defecto) o prod

Instalación por cliente: https://developer.1platform.pro/docs/saas/1platform-api/integrar-con-ia

Uso alojado (HTTP)

node dist/cli.js --http sirve Streamable HTTP sin estado en POST /mcp y GET /healthz. Las claves llegan en X-OnePlatform-App-Key y X-OnePlatform-User-Key en cada solicitud; el entorno lo fija ONEPLATFORM_ENV al arrancar. Límites: 30 solicitudes por minuto por IP, 120 por par de claves y 256 KiB por cuerpo.

El despliegue alojado (contenedor junto al API, IP del cliente hacia el API) está pendiente de medir la cadena de proxies en el host real. Hasta entonces el transporte HTTP no escribe X-Forwarded-For y no debe exponerse.

Comportamiento

  • Canjea las claves por los dos tokens una vez y los reutiliza hasta dos minutos antes de vencer; un canje fallido se recuerda 60 s.

  • Ante un 401 vuelve a canjear el token de usuario y, si sigue, el de aplicación (como mucho una vez por minuto). Un 429 no se reintenta.

  • Devuelve el cuerpo y el código de estado del API tal cual, marcados como datos no confiables, recortados a 100 KiB. Quita bank_authorization de las transacciones y el token de los sitios.

  • Los parámetros de ruta se validan contra un patrón fijo: .., / o % se rechazan sin llamar a la red.

  • Ninguna clave ni token aparece en los registros.

Desarrollo

npm ci
npm run fetch-openapi   # copia del OpenAPI público (no se versiona)
npm run build-tools     # regenera src/generated/tools.ts desde el manifiesto
npm test
npm run build

Publicar en npm lo decide el dueño del paquete: ningún flujo de CI publica.

Available Tools

3 tools
api_get_operationA
Read-only

Devuelve el contrato exacto de una operación de la OnePlatform API (método, ruta, parámetros, cuerpo, respuestas y códigos de error) a partir de su operationId. No necesita claves.

NameRequiredDescriptionDefault
operationIdYes

TDQS

A3.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint and openWorldHint, but the description adds a genuinely new behavioral fact the annotations do not encode: "No necesita claves" (no authentication required). It also discloses the shape of what is returned, which is valuable for a read tool with no output schema. It does not cover failure behavior for an unknown operationId or any caching/rate-limit traits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tight sentences, front-loaded with the returned content, then the auth constraint. No filler or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The enumeration of return fields compensates well for the absent output schema, but with 0% parameter documentation and no sibling differentiation, an agent still lacks guidance on where operationIds come from and how this differs from the two docs_* tools.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% for the single required parameter, so the description must compensate. It only repeats that input is an "operationId" and adds no format, origin (e.g., from docs_search results), or validity guidance beyond the regex already in the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource ("Devuelve el contrato exacto de una operación de la OnePlatform API") and enumerates exactly what the contract contains: método, ruta, parámetros, cuerpo, respuestas y códigos de error. It does not, however, name or contrast the sibling tools (docs_search, docs_get_page), so an agent must infer the boundary itself.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is only implied: the tool is the one to call when you have an operationId and need the full API contract. There is no explicit when-to-use vs. when-not, and no mention of the sibling docs tools as alternatives or prerequisites (e.g., how to first obtain an operationId).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

docs_get_pageA
Read-only

Devuelve una página de la documentación de OnePlatform en Markdown. Acepta la ruta de la página (por ejemplo /docs/saas/1platform-api/links-de-pago) o su URL. No necesita claves.

NameRequiredDescriptionDefault
pathYesRuta o URL de la página en developer.1platform.pro.

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=true, so the safety profile is covered. The description adds genuinely useful behavioral context on top: the payload is returned in Markdown and no credentials are needed, which tells the agent it can call it blind. What it does not say is what happens on a nonexistent path or whether content is paginated.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short sentences: what it returns, what it accepts with an example, and the auth note. Front-loaded with the outcome and zero redundant text.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter read-only fetch with a fully documented schema and no output schema, the description covers return format (Markdown) and auth needs. Only error/not-found behavior is left unaddressed, a minor gap at this complexity level.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and the schema already says the parameter accepts a route or URL on developer.1platform.pro. The description nevertheless adds a concrete worked example path (/docs/saas/1platform-api/links-de-pago), which is the piece agents most often guess wrong, so it edges above the baseline 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: returns a OnePlatform documentation page in Markdown, which an agent can instantly tell apart from docs_search or api_get_operation. It does not explicitly name a sibling to contrast against, so it stops short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is only implied by the name and by the note that no keys are required. There is no explicit guidance on when to use this versus docs_search (e.g. 'use this when you already have the path; use docs_search to find it'), and no exclusions or prerequisites beyond the auth note.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 3 tool updatesv0.1.1
    • First observedapi_get_operation
    • First observeddocs_get_page
    • First observeddocs_search

TDQS

A3.8/5.0

Scored across 3 tools

Disambiguation5/5

The three tools occupy clearly separate niches: free-text documentation search, direct documentation page retrieval by path/URL, and exact API operation contract lookup by operationId. Search vs. fetch is a well-understood pair, and the API-reference tool is a distinct resource entirely. No two tools could plausibly be confused for one another.

Naming Consistency5/5

All names follow a strict {domain}_{action} snake_case pattern (docs_search, docs_get_page, api_get_operation), with clear domain prefixes distinguishing documentation from API concerns. Verb choice is consistent and readable throughout.

Tool Count4/5

Three tools is a tight, purposeful surface with no redundancy, and each covers a genuinely different retrieval need. It sits at the low end of comfortable scope, leaving some room for additional reference operations, but nothing feels padded.

Completeness3/5

Documentation search, page fetch, and operation lookup cover the core reference workflow, but there is no way to enumerate or list available API operations, so api_get_operation depends entirely on the caller already knowing an operationId (or the docs surfacing it). No listing/browsing or discovery operation is a notable gap for an API-reference server.

Maintenance

ActivityMaintained
ResponsivenessUnresponsive

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    C
    maintenance
    Enables coding agents and chat clients to inspect proxy tokens, usage, pools, geo targeting, and build ready-to-use proxy connection URLs via the Litport account API, while remaining read-only.
    374 npm
    MIT
  • A
    license
    B
    quality
    B
    maintenance
    Gives coding agents read-only access to an AI-SPM backend's flagged issues, inventory, and remediation guidance so they can fix the affected code, along with guardrail policies, LLM-interaction analytics, cost-optimization analyses, and red-teaming evaluation results.
    37
    35 PyPI
    Apache 2.0
  • A
    license
    A
    quality
    B
    maintenance
    Enables agents to explore org-wide context across domains, repositories, and data sources; read and participate in GitHub Discussions; and run read-only SQL queries over public GCS parquet datasets.
    11
    MIT
  • A
    license
    A
    quality
    A
    maintenance
    Enables a coding agent to get short, token-efficient answers about a project through grouped searches, focused symbol or section reads, and bounded read-only script output, with safety limits on paths, secrets, commands, and response size.
    3
    MIT