portal-api
This read-only MCP server provides access to Portal.io account data through a set of tools, allowing you to test credentials, browse proposals, search contacts, list users, and search the catalog (if enabled). All operations are strictly read-only; no creating, updating, archiving, or sending data is possible.
test_connection: Verify Portal.io API credentials are valid.
list_proposals: List/search proposals with filters (status, contact, text, date modified) and pagination.
get_proposal: Get complete proposal details by ID.
list_users: List active users, useful for finding salesperson IDs.
search_contacts: Search contacts by name, company, email, phone, or contact type (Person/Company), with sorting and pagination.
search_catalog: Search the product catalog by brand, category, text, or stock status; requires Catalog API access to be enabled.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@portal-apilist my recent proposals"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Portal.io API MCP
A local, read-only MCP server for a Portal.io account. It signs API requests with Portal's HMAC-SHA256 scheme and makes account data available to Codex through structured tools.
Included tools
test_connection: confirm the current credentials can make a read-only request.list_proposalsandget_proposal: browse proposal summaries and details.list_users: look up Portal salesperson IDs.search_contacts: find contacts in the Portal account.search_catalog: search account catalog items when Catalog API access is enabled.
Version 0.1.1 contains no mutation tools. It cannot create, update, archive, or send anything in Portal.
Related MCP server: readonly-mcp-server
Install
git clone https://github.com/AWfusion/portal-api-mcp.git
cd portal-api-mcp
npm ci
cp .env.example .envFill in .env with credentials from the same Portal environment:
PORTAL_ENV=sandbox
PORTAL_BASE_URL=https://sandbox.api.portal.io
PORTAL_APP_ID=your-api-application-key
PORTAL_SECRET_KEY=your-secret-key
PORTAL_USER_API_KEY=the-meta-apiKey-value-from-the-credential-exchange
PORTAL_WRITE_ENABLED=falseFor production, use PORTAL_ENV=production and PORTAL_BASE_URL=https://api.portal.io only when Portal has issued and enabled production credentials for the integration.
PORTAL_USER_API_KEY must be the exact meta.apiKey returned by GET /authenticate/apikeyexchange. Do not substitute the application ID, secret key, a Portal UI token, or the username/password used for the one-time exchange. Portal's returned User API Key is Base64-encoded and is normally 44 characters long.
The actual .env file is ignored by Git. Keep its permissions owner-only:
chmod 600 .envVerify
npm test
npm run verifynpm run verify performs a local MCP initialization, confirms every tool is registered, and makes one read-only GET /public/proposals?PageNumber=1&PageSize=1 call. It outputs no credentials.
Register Globally in Codex
Run the included installer from the project directory:
./scripts/install-codex-mcp.shIt registers this local process globally under the name portal-api. Confirm it with:
codex mcp get portal-apiRestart Codex or open a new task after registration so the tools are discovered. Typical requests include “list my most recently modified Portal proposals” and “search the catalog for Denon receivers.”
Troubleshooting
app id could not be found: the API application ID is not enabled for the selected base URL. Sandbox credentials belong athttps://sandbox.api.portal.io; production credentials belong athttps://api.portal.io.request signature (hash) is invalid: first confirmPORTAL_USER_API_KEYis the Base64meta.apiKeyreturned by the credential exchange, then confirm the app ID, secret, and User API Key all came from the same environment.Catalog queries return authorization errors: ask Portal to enable Catalog API access for the account.
Development
The server uses Node 20 or newer and has no database or hosted component. Request signing follows Portal's current API contract: GET signatures include the fully encoded request URL and omit the content type; the API secret is used as the raw ASCII HMAC key and is not Base64-decoded.
See CHANGELOG.md for release history and BUILD-INFO.md for the release contract.
Available Tools
6 toolsget_proposalA
Get complete details for one Portal.io proposal. Read-only.
| Name | Required | Description | Default |
|---|---|---|---|
| proposal_id | Yes | Portal proposal ID. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
States 'Read-only', which is a key behavioral trait, but no annotations exist; description does not cover error handling, auth requirements, or rate limits. Adequate but minimal.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Extremely concise: 8 words plus 'Read-only.' Front-loaded with the action and resource, no wasted text.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simplicity (1 param, no output schema), the description sufficiently covers what the tool does. Could mention what 'complete details' includes, but not essential.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the description merely echoes the schema's parameter description ('Portal proposal ID.') without adding meaning or constraints (e.g., type, range). Baseline score of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the verb 'Get' and resource 'complete details for one Portal.io proposal', distinguishing it from siblings like list_proposals (which lists multiple) or search_catalog (which searches different entities).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Implies usage when needing single proposal details, but provides no explicit when-not-to-use or alternatives (e.g., when to use list_proposals instead).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_proposalsB
List or search Portal.io proposals. Read-only.
| Name | Required | Description | Default |
|---|---|---|---|
| sort_by | No | ||
| statuses | No | Optional Portal proposal status filters. | |
| page_size | No | Results per page, up to 100. | |
| contact_id | No | Optional Portal contact ID. | |
| is_archive | No | ||
| page_number | No | Page number, starting at 1. | |
| search_text | No | Optional text to match against proposals. | |
| modified_after | No | Optional UTC ISO timestamp. | |
| sort_direction | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It states 'Read-only' which is helpful, but it does not disclose pagination, filtering behavior, or that it returns a list of proposals. The description is too minimal for a tool with 9 parameters and no output schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no wasted words. It is concise but sacrifices completeness; however, for a list/search tool a brief description can suffice. The structure is front-loaded with purpose and read-only nature.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite 9 parameters and no output schema, the description provides no guidance on how to use the parameters effectively, no explanation of search vs list behavior, and no context on pagination or output format. The sibling tools are listed but not compared. The description is inadequate for the complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 67% (6 of 9 parameters have descriptions). The description adds no additional parameter meaning beyond the schema. The word 'search' implies filtering, but no parameter details are given. Baseline 3 is appropriate given moderate coverage and no added value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states the tool lists or searches Portal.io proposals. The verb and resource are specific. However, it does not differentiate from the sibling 'get_proposal' which likely retrieves a single proposal, so the distinction between list and search is implied but not explicit.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description mentions 'Read-only', indicating it should not be used for mutations. However, it provides no guidance on when to use this tool versus alternatives like 'get_proposal' or how to choose between list and search behaviors. No explicit when-to-use or when-not-to-use.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_usersA
List active users in the Portal.io account. Use this to find salesperson IDs. Read-only.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description explicitly states 'Read-only' and 'List active users,' disclosing key behavioral traits. With no annotations provided, the description carries the full burden and adequately conveys safety and scope.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the action and scope, followed by usage guidance. Every word earns its place, with no redundancies.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple, parameterless list tool, the description covers the key points: what it returns (active users), purpose (find IDs), and side effects (read-only). It could mention return fields, but the lack of output schema makes this acceptable.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are zero parameters, so the schema coverage is 100%. The description does not need to add parameter details. Baseline 4 applies due to no parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it lists active users in the Portal.io account, with a specific purpose of finding salesperson IDs. It distinguishes itself from sibling tools like list_proposals and search_contacts, making the tool's unique role obvious.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says 'Use this to find salesperson IDs,' which provides clear context for when to use the tool. However, it does not mention when not to use it or compare directly to alternatives, so it lacks full exclusion guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_catalogB
Search the Portal.io catalog. Catalog API access must be enabled for the account. Read-only.
| Name | Required | Description | Default |
|---|---|---|---|
| brand | No | ||
| in_stock | No | ||
| page_size | No | Results per page, up to 100. | |
| category_id | No | ||
| page_number | No | Page number, starting at 1. | |
| search_text | No | Product, brand, or model search text. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description carries burden. States 'Read-only' (behavioral) and prerequisite, but does not describe pagination, rate limits, or return format.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no wasted words: purpose and a key prerequisite+behavior. Highly efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 6 optional parameters, no output schema, and no annotations, the description is too sparse. Missing guidance on search behavior, parameter combining, and result details.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 50%; description adds no extra parameter meaning beyond what schema already provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clear verb+resource: 'Search the Portal.io catalog.' Distinguishes from sibling tools like search_contacts by resource, but does not explicitly differentiate.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Mentions prerequisite (Catalog API access must be enabled) and read-only nature, but lacks explicit when/when-not guidance or alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_contactsB
Search or list Portal.io contacts. Read-only.
| Name | Required | Description | Default |
|---|---|---|---|
| sort_by | No | ||
| page_size | No | Results per page, up to 100. | |
| page_number | No | Page number, starting at 1. | |
| search_text | No | Optional contact name, company, email, or phone text. | |
| contact_types | No | ||
| sort_direction | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It only states 'Read-only', which is a behavioral trait, but lacks details on pagination behavior, rate limits, authentication needs, or how the search logic works. Minimal transparency beyond the read-only attribute.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very short—one sentence plus a fragment—with no wasted words. It is concise, but could slightly expand on critical usage points without becoming verbose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema and no annotations, the description is insufficient. It does not explain return values, pagination behavior, or how filtering works across contact types. For a search tool with 6 parameters, more contextual information is needed for an agent to invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 50% (3 of 6 parameters have descriptions). The tool description adds no additional meaning to the parameters; it does not explain how 'search_text' interacts with 'contact_types' or the effect of 'sort_by' and 'sort_direction'. The description fails to compensate for the undocumented parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb ('search or list') and resource ('Portal.io contacts'), and adds a behavioral note ('Read-only'). It distinguishes from siblings like 'list_proposals' and 'search_catalog' by specifying contacts.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description does not provide explicit when-to-use or when-not-to-use guidance, nor does it mention alternative tools. However, the context of sibling tools makes it clear that this is for contacts, so usage is reasonably implied.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
test_connectionA
Confirm that the configured Portal.io API credentials work. This is read-only and returns only proposal metadata.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It mentions read-only and return of proposal metadata, but does not disclose error behavior, latency, or potential side effects. Adequate for a simple test call but lacks depth.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no wasted words. The key information (purpose, read-only, return type) is front-loaded and clear.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with no output schema, the description covers basic purpose and return type. However, it lacks details on error handling or what happens on failure, which would improve completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has no parameters, so schema description coverage is 100%. The description provides context that the tool tests credentials and returns metadata, adding value beyond the empty schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it is a credential test for Portal.io API, using the verb 'Confirm' and specifying 'read-only' and 'returns only proposal metadata'. This distinguishes it from sibling tools like get_proposal or list_proposals which retrieve data.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool is for testing credentials but does not explicitly state when to use it versus alternatives. No guidance on prerequisites or exclusions is provided, though the purpose is straightforward.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
6 tool updates
v0.1.0- First observed
get_proposal - First observed
list_proposals - First observed
list_users - First observed
search_catalog - First observed
search_contacts - First observed
test_connection
TDQS
Scored across 6 tools
Each tool targets a distinct resource and action: proposals (get/list), users (list), catalog (search), contacts (search), and connection test. No overlap.
All tool names follow a consistent verb_noun pattern in snake_case (e.g., get_proposal, list_users, search_catalog).
6 tools is appropriate for a read-only API surface covering proposals, users, catalog, contacts, and connection verification.
Covers the main read operations for key entities, but lacks get_user or get_contact individually; however, this is reasonable for the scope.
Maintenance
Related MCP Connectors
Read-only MCP server for The Quiet Protocol's engines, benchmarks, proof, and business data.
An MCP server that provides read access to your cloud storage providers, bank accounts and more.
Public, read-only MCP server for FarmNeural company facts, packages, and capabilities.
Read-only MCP server: verify credentials and browse escrows on the Stellar testnet contract.
Related MCP Servers
- AlicenseAqualityBmaintenanceRead-only MCP server for the RareCloud API, enabling AI agents to list servers, browse the catalog, check billing, and plan deployments.1005 npmMIT
- FlicenseNot gradedqualityCmaintenanceA read-only MCP server with configurable transport (stdio or HTTP+SSE), API key authentication, and scope-based authorization for read and search operations on documents.-
- AlicenseAqualityDmaintenancePortable, read-only MCP server for Nous Portal capabilities, providing configuration status, route derivation, and OAuth device code authentication without invoking paid tools.4MIT
- AlicenseNot gradedqualityCmaintenanceA read-only MCP server that provides tools to list and read devices, MDM servers, blueprints, configurations, apps, packages, users, and other resources from Apple Business Manager and Apple School Manager.MIT