Schema | mcp-api-proxy

mcp-api-proxy

Overview Schema Source Related Servers Discussions Admin

Server Configuration

Describes the environment variables required to run the server.

Name	Required	Description	Default
`CLIENT_ID`	No	OAuth2 client ID from Developer Portal; partial auth settings produce a startup warning naming missing variables
`TOKEN_SCOPE`	No	OAuth2 scope for the Premium API product (single scope per process — restart for another)	accounts
`MCP_HTTP_HOST`	No	HTTP bind address (only in --transport http mode). Use 0.0.0.0 only behind your own auth/reverse proxy.	127.0.0.1
`MCP_HTTP_PORT`	No	HTTP listen port (only in --transport http mode)	3001
`CLIENT_KEY_PEM`	No	Path to PEM-encoded private key (may be encrypted)
`LIVE_TOKEN_URL`	No	Override live/production token endpoint; complete live credentials make live the default tier (real data, GET only)
`MCP_SERVER_URL`	No	Override upstream MCP server URL.	https://mcp.danskebank.com/mcp
`CLIENT_CERT_PEM`	No	Path to PEM-encoded x509 client certificate for mTLS (shared by both sandbox and live tiers)
`MCP_TRUST_PROXY`	No	When 1/true, trust X-Forwarded-For header for client IP detection. Only enable behind a trusted reverse proxy.
`MCP_MAX_SESSIONS`	No	Maximum concurrent HTTP sessions. New connections receive 503 when full.	100
`MCP_API_HOST_LIVE`	No	Override the live API host.	api.danskebank.com
`MCP_API_HOST_MOCK`	No	Override the mock API host.	mock-api.danskebank.com
`SANDBOX_TOKEN_URL`	No	Override sandbox token endpoint, e.g. for the Payment Collection API (see token URL defaults)
`MCP_SERVER_API_KEY`	Yes	API key sent as X-API-Key. Required for the hosted MCP server, including production; omit only for custom upstream servers that do not require a key.
`MCP_SERVER_CA_CERT`	No	Optional additional CA bundle for custom upstream MCP server or API hosts. Not bundled — supply your own path, same as CLIENT_CERT_PEM.
`MCP_SESSION_TTL_MS`	No	Idle session TTL in milliseconds. In-flight POST requests are protected; idle time starts when they finish.	1800000
`MCP_API_HOST_SANDBOX`	No	Override the sandbox API host.	sandbox-api.danskebank.com
`CLIENT_KEY_PASSPHRASE`	No	Passphrase for CLIENT_KEY_PEM
`MCP_RATE_LIMIT_PER_IP`	No	Max new sessions a single IP can create per rate-limit window.	10
`MCP_RATE_LIMIT_WINDOW_MS`	No	Sliding window duration (ms) for the per-IP session creation rate limit.	60000

Instructions

Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.

This server publishes no instructions, or was last inspected before Glama recorded them.

Capabilities

Features and capabilities supported by this server

Protocol revision2025-11-25

Capability	Details
`tools`	{ "listChanged": true }

Tools

Functions exposed to the LLM to take actions

Name Description

Name	Description
call_endpointA	Execute a request against a Danske Bank API. Only Premium APIs are supported (client_credentials grant, no PSD2 consent flows). Tiers: mock = mock-api.danskebank.com (sample data, no auth). Default tier: mock. HOW TO BUILD `url`: in the API's OpenAPI spec, pick the `servers` entry of the tier you call: the entry whose host is that tier's host above, whatever its position in the list (mock is often first). Append the operation path to the path of that entry. Example: entry `https://api.danskebank.com/corporate/api` + operation `/v1/accounts/list` → url `/corporate/api/v1/accounts/list`. The operation path alone returns 404. A full URL also works if it is https:// on the tier's host, without port or credentials. The proxy adds the client certificate and bearer token for sandbox and live. Results include the resolved tier, status, headers and body as structuredContent and matching JSON text. Only HTTP 2xx is API success; a redirect is not success. HTTP 400 and above sets isError with error.category, error.retryable and error.nextStep. Check the expected response body before reporting business success.

call_endpointA

Execute a request against a Danske Bank API. Only Premium APIs are supported (client_credentials grant, no PSD2 consent flows). Tiers: mock = mock-api.danskebank.com (sample data, no auth). Default tier: mock. HOW TO BUILD url: in the API's OpenAPI spec, pick the servers entry of the tier you call: the entry whose host is that tier's host above, whatever its position in the list (mock is often first). Append the operation path to the path of that entry. Example: entry https://api.danskebank.com/corporate/api + operation /v1/accounts/list → url /corporate/api/v1/accounts/list. The operation path alone returns 404. A full URL also works if it is https:// on the tier's host, without port or credentials. The proxy adds the client certificate and bearer token for sandbox and live. Results include the resolved tier, status, headers and body as structuredContent and matching JSON text. Only HTTP 2xx is API success; a redirect is not success. HTTP 400 and above sets isError with error.category, error.retryable and error.nextStep. Check the expected response body before reporting business success.

Prompts

Interactive templates invoked by user choice

Name	Description
No prompts

Resources

Contextual data attached and managed by the client

Name	Description
No resources

Deploy Server

Claude Code, inside the Godot 4 editorFlockbay puts an AI agent in the real Godot 4 editor: it writes GDScript, runs your game and fixes what breaks. Free, or bring your own Claude Code or Codex.flockbay.comAd

TDQS

A4.3/5.0

Scored 2026-11-03 15:50 across 1 tool

Disambiguation5/5

There is only one tool, so there is no possibility of confusing it with another tool. Its purpose—executing a request against a Danske Bank API endpoint—is clear and unambiguous.

Naming Consistency4/5

The single tool name, call_endpoint, follows a recognizable verb_noun convention and is readable. With only one tool there is no broader naming pattern to validate, so it cannot score a perfect 5 for set-level consistency.

Tool Count3/5

A single generic proxy tool is a reasonable design for dynamically calling many API endpoints. However, one tool is thin for the apparent domain and forces agents to handle discovery, URL construction, and auth interpretation entirely through one long description.

Completeness3/5

The core execution operation is present and appears capable of covering many API calls. Notable gaps remain around API/spec discovery, tier listing, auth diagnostics, and PSD2 or non-premium flows, which agents must work around externally.

Maintenance

ActivityMaintained

ResponsivenessNo recent community issues