Hub MCP server
It is an MCP server that lets an AI assistant discover, inspect, and safely call the Healthier Business Hub API v2 (plus task-focused workflows) from a sandbox or live environment.
Check connection and key details with
hb_status, and search/describe any Hub operation before calling it.Call API operations through
hb_call_operation, with spec validation, pagination, field selection, idempotency, and read-only protection by default.Browse and inspect webhook events and verify webhook signatures locally.
Search bundled API and developer-portal guides without needing a key.
Use task tools for common jobs: candidate lookup and compliance overview, training progress, bookings, credits, account summaries, alerts, billing, reports, webhook health, go-live checks, and certificate verification status.
Perform write workflows as a two-step plan-and-confirm flow: bookings, candidate updates, training assignment, reference requests, occupational health requests, worker verification, alert acknowledgement, CSV imports, webhook redelivery/secret rotation, sandbox webhook setup, and certificate upload.
Stay safe by default: read-only until enabled, sandbox-first, live writes requiring explicit approval, no secrets exposed, and no automatic retries of writes.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Hub MCP servercheck my Hub connection status and confirm I'm on the sandbox"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Hub MCP server
@healthier-business/hub-mcp is a Model Context Protocol server for the Healthier Business Hub API v2. It lets an AI assistant (Claude Code, Claude Desktop, Cursor, Codex, any MCP client) use every Hub endpoint: 200 operations across the Hub core and ten portals, plus the 66 webhook events as knowledge.
It is built to be safe by default:
Read-only until the owner turns writes on.
Sandbox first. Live is real people and real credits; the server always says which one you are on.
Live writes are a two-step: the first call returns a plan and sends nothing; the second needs
confirm: true.Keys never reach the model or a log. The API key comes only from the environment.
Package: @healthier-business/hub-mcp. Command: hb-hub-mcp. Needs Node 20 or newer.
Quickstart (sandbox first)
You need Node 20+, a sandbox base URL and a sandbox API key (hbk_test_...) from the developer portal. Sandboxes are separate from the Hub and hold synthetic data; see hb://guides/testing-and-sandbox. A live key is hbk_... from the Hub's Developer page.
Check your setup first (prints the mode and scopes, never the key):
HB_API_KEY=hbk_test_... HB_BASE_URL=https://YOUR-SANDBOX-URL npx -y @healthier-business/hub-mcp --doctorClaude Code
export HB_API_KEY=hbk_test_... # in your shell, not in chat
claude mcp add hb-hub --scope project \
--env HB_API_KEY="$HB_API_KEY" --env HB_BASE_URL="https://YOUR-SANDBOX-URL" --env HB_READ_ONLY=true \
-- npx -y @healthier-business/hub-mcpThen ask Claude to check the connection: "Run hb_status". It tells you whether you are on the sandbox or live, which key it is using and what the key may do.
Or install it as a Claude Code plugin. The plugin adds the server, a safe-workflow skill and two commands, /hb-hub:status and /hb-hub:sandbox-test. In Claude Code run:
/plugin marketplace add Healthier-Business/hb-mcp
/plugin install hb-hub@healthier-businessClaude Code then asks for your sandbox API key (it starts with hbk_test_ and is kept in your system's secure storage) and your sandbox base URL. Both come from your sandbox in the developer portal. To change them later, run /plugin configure hb-hub@healthier-business. The plugin has no default URL, so it never points at the live Hub by accident. HB_READ_ONLY, HB_ALLOW_LIVE_WRITES, HB_TOOL_MODE, HB_TASK_TOOLS, HB_UPLOAD_DIRS and HB_LOG_LEVEL are read from your shell if you want to change them (HB_UPLOAD_DIRS is empty by default: only the folder Claude Code was started in is readable by hb_verify_certificate).
Claude Desktop
Edit claude_desktop_config.json (Settings, Developer, Edit Config) and add this block. Desktop has no variable interpolation, so the key sits in that file: use a sandbox key here. Restart Claude Desktop.
{
"mcpServers": {
"hb-hub": {
"command": "npx",
"args": ["-y", "@healthier-business/hub-mcp"],
"env": {
"HB_API_KEY": "hbk_test_PASTE_YOUR_SANDBOX_KEY_HERE",
"HB_BASE_URL": "https://YOUR-SANDBOX-URL",
"HB_READ_ONLY": "true"
}
}
}
}Cursor
Project: save this as .cursor/mcp.json (it reads HB_API_KEY and HB_BASE_URL from your environment with ${env:...}). Global: ~/.cursor/mcp.json.
{
"mcpServers": {
"hb-hub": {
"command": "npx",
"args": ["-y", "@healthier-business/hub-mcp"],
"env": {
"HB_API_KEY": "${env:HB_API_KEY}",
"HB_BASE_URL": "${env:HB_BASE_URL}",
"HB_READ_ONLY": "true"
}
}
}
}One-click install link (fills in placeholders you must replace afterwards in Settings, MCP):
cursor://anysphere.cursor-deeplink/mcp/install?name=hb-hub&config=eyJjb21tYW5kIjoibnB4IiwiYXJncyI6WyIteSIsIkBoZWFsdGhpZXItYnVzaW5lc3MvaHViLW1jcCJdLCJlbnYiOnsiSEJfQVBJX0tFWSI6IllPVVJfU0FOREJPWF9LRVkiLCJIQl9CQVNFX1VSTCI6Imh0dHBzOi8vWU9VUi1TQU5EQk9YLVVSTCJ9fQ%3D%3D
Codex
Add this to ~/.codex/config.toml:
[mcp_servers.hb-hub]
command = "npx"
args = ["-y", "@healthier-business/hub-mcp"]
env_vars = ["HB_API_KEY"] # forwarded from your shell
[mcp_servers.hb-hub.env]
HB_BASE_URL = "https://YOUR-SANDBOX-URL"
HB_READ_ONLY = "true"Any other client
stdio: command npx, args -y @healthier-business/hub-mcp, environment as in the table below. HTTP: hb-hub-mcp --http --port 3333 serves Streamable HTTP at http://127.0.0.1:3333/mcp.
Then go live
When it works in the sandbox, follow the go-live-checklist prompt (or hb://guides/going-live): create a live key with least-privilege scopes, point HB_BASE_URL at https://hub.hbcompliance.co.uk (or remove it), run --doctor, and keep HB_READ_ONLY=true until the owner is ready for live writes.
Related MCP server: basecamp-mcp-server
Tools
Compact mode (default, HB_TOOL_MODE=compact): 8 tools plus the task tools
MCP clients degrade or cap beyond about 40 tools, so the default is a handful of meta tools that reach all 200 operations, plus curated task tools for the common jobs (below): 22 tools read-only and 38 with writes enabled (HB_TASK_TOOLS changes that).
Tool | What it does |
| Who am I: environment (live/sandbox), base URL, key name and prefix, scopes, whether writes are enabled, last rate limit. |
| Search the operations by text, toolset (portal), method or scope. Says which are callable now and which the key's scopes allow. |
| Full detail: parameters, body schema with required fields and example, scope, credits, health data, errors, idempotency, a ready example call. |
| Call any operation by id with |
| The 66 webhook events (filter by portal or text). |
| One event: payload schema, sample, delivery headers, verification rule. |
| Local, no network: verify or compute |
| Local, no network, no key needed: keyword search over the 36 bundled guides (15 API, 21 developer portal); returns the best matches with a snippet and the |
Task tools (compact and full mode)
Task tools do a common job in one call with sensible defaults, so an assistant does not have to search, describe and call several operations. They run through the same pipeline as hb_call_operation (spec validation, read-only default, live-write gate, idempotency, secret redaction, size cap, error mapping), check the key's scopes first and only call what is allowed, name what they skipped and why, and list the operation ids they called (readable text first, then structured data). They respect HB_TOOLSETS (a task tool is hidden when its portals are not enabled) and HB_TASK_TOOLS (below).
Every task tool that writes is a two-call flow. The first call reads only and returns the options or the plan (who will be emailed, what credits or fees apply, a field-by-field diff for updates) and sends nothing. The second call, with confirm: true after the user agreed, does it, with idempotency keys (the plan returns the key to reuse). This holds in a sandbox and on live; on live the server must also allow live writes (HB_READ_ONLY=false and HB_ALLOW_LIVE_WRITES=true). Write task tools are hidden while the server is read-only. Where a Hub call can email a real person, the plan says so.
Read tools (14):
Tool | What it does |
| Find candidates by name, email, own reference or |
| One line per record (status and dates) across online training, practical training, virtual BLS, references, DBS and right to work, registration monitoring, clinical appraisals, clinical interviews, certificate verifications (linked by |
| One candidate's online training: summary, courses with grade and dates, modules by status, practical results, one course in full, the assignable catalogue. |
| Bookings across practical training (with no-shows), virtual BLS, clinical interviews and clinical appraisals in one table; filter by portal, candidate, dates, status. No contact details. |
| Credits and balances for every portal the key can reach (including Training Verification: money, automated and manual credits, older balance), recent transactions, and the occupational health credit packages. |
| The key (name, expiry, scopes), credits and webhook health in one answer. |
| Failed webhooks, unacknowledged alerts, bookings awaiting payment, appraisals awaiting documents, lapsing training, expired reference requests, certificate verifications that failed or sit pending for over an hour, occupational health counts only. |
| Alerts from DBS/RTW, registration monitoring and occupational health with filters; one alert in full. Occupational health alerts are statuses only. |
| A DBS/RTW or registration worker: current result, last checks, evidence metadata (type, date, size). Masked certificate numbers only; no date of birth, contact details or files. |
| Usage (trial, billing type, estimate) and bills for DBS/RTW and registration monitoring. |
| Certificate and report details and exactly how to download them (practical, virtual BLS and online training certificates, interview report, appraisal evaluation report, occupational health reports list, and the Training Verification report and submitted certificate). File bytes are never returned. |
| Endpoints with active flag and consecutive failures, recent failed deliveries and a response code summary. URLs without query strings. |
| Readiness report: environment, key type, wildcard and expiry warnings, scopes against the |
| Follow certificate verifications: list (filter by status, request type, |
Write tools (16, two calls each):
Tool | What it does |
| Options, plan, then hold and book a practical training session; |
| Virtual BLS timeslot, clinical interview timeslot or clinical appraisal (param |
| Cancel (practical, virtual BLS, interviews, and |
| Practical training booking invitations: create, list (read-only), delete. One-time links are not shown. |
| Create (refuses a duplicate without |
| Assign online courses without removing existing ones unless named; optional reminder email. |
| Request references ( |
| Create an occupational health request from the request options; no health answers are handled. |
| Reference reminders, extend, cancel; occupational health and online training reminder emails; the plan lists who is contacted. |
| Add and verify a DBS/RTW or registration worker, or re-check one. Share codes and certificate numbers appear only masked and are scrubbed from errors. |
| Acknowledge DBS/RTW or registration alerts (one, ids, a type, or all open only when explicit); dismiss or clear occupational health alerts. |
| CSV import into DBS/RTW or registration monitoring: preview first (counts and row errors, no sample rows), then import. |
| Redeliver failed webhook deliveries (the plan lists them). |
| Rotate an endpoint's signing secret. The new secret is never returned: |
| Sandbox only: create an endpoint, send a test event, report the delivery. Refuses on live. Same secret handling ( |
| Verify a training certificate file (PDF, JPG or PNG) on this machine. Call 1 checks the file locally and shows file name, size, type and SHA-256, who gets the result email, the price (Automated is free for regular accounts, charged for verification-only accounts; Manual is always charged; credits or wallet, no card) and the balance, and sends nothing. Call 2 ( |
Not built as tools: submitting occupational health answers, deleting workers or endpoints, evidence upload, downloading a verification's certificate or report (hb_get_report says how), token operations (use hb_call_operation where allowed). Right to work document or passport uploads are not supported by hb_verify_worker (share codes are).
HB_TASK_TOOLS chooses how many task tools are offered: all (default, 30), core (11: hb_find_candidate, hb_candidate_overview, hb_account_summary, hb_needs_attention, hb_go_live_check, hb_book_practical_training, hb_setup_sandbox_webhook, hb_credits, hb_list_bookings, hb_webhook_health, hb_verification_status) or none. Tool counts in compact mode: all is 8 + 14 = 22 read-only and 8 + 30 = 38 with writes; core is 17 read-only and 19 with writes; none is 8. If your client caps tools around 40, all fits with writes on but leaves little room for other servers: use core.
Full mode (HB_TOOL_MODE=full)
One tool per operation, generated from the bundled spec, named from the operation id (hub.candidates.list becomes hub_candidates_list), plus hb_status, hb_list_events, hb_describe_event, hb_verify_webhook_signature, hb_search_guides and the task tools above. Path and query parameters are top-level arguments, body is the JSON body. Annotations (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) come from the method and the spec's flags. While HB_READ_ONLY=true, write tools are hidden.
Toolset ( | Operations | Reads | Writes |
| 4 | 2 | 2 |
| 10 | 4 | 6 |
| 4 (1 exposed) | 1 | 3 |
| 14 | 12 | 2 |
| 30 | 24 | 6 |
| 11 | 5 | 6 |
| 20 | 14 | 6 |
| 14 | 9 | 5 |
| 13 | 8 | 5 |
| 29 | 17 | 12 |
| 32 | 19 | 13 |
| 8 | 7 | 1 |
| 11 | 9 | 2 |
Total | 200 | 131 | 69 |
Tool counts in full mode: all toolsets with writes on is 197 operation tools + 5 helpers + 30 task tools = 232; read-only (default) is 131 read tools + 5 + 14 task tools = 150 (auth.me is the only authentication tool). With HB_TASK_TOOLS=core that is 213 and 145 (writes on, read-only), with none 202 and 136. Use HB_TOOLSETS to stay under your client's limit, for example HB_TOOLSETS=hub,occupational-health.
The three credential operations (auth.token.create, auth.refresh.create, auth.revoke.create) are never exposed: the server exchanges the key and refreshes tokens itself, so a key or token never passes through a tool call.
Resources and prompts
Resources: hb://guides/<name> (the 15 API developer guides and 21 developer portal guides, 36 in all; API guides: authentication, errors, scopes-and-permissions, idempotency, webhooks, going-live, ...), hb://portals/<toolset>, hb://spec/overview, and templates hb://spec/operations/{id}, hb://spec/events/{type}.
Prompts: get-started-in-sandbox (sign up, sandbox, key, --doctor, first read), book-practical-training, check-candidate-compliance, webhook-sandbox-setup, go-live-checklist, onboard-candidate, verify-a-certificate (price and balance check, file check, submit, follow the status and the webhook).
Developer portal guides
The developer portal is where a developer signs up, makes sandboxes, test keys and webhooks, and uses the API Playground. Its 21 usage guides are bundled as resources hb://guides/portal-<name> (source files in content/guides/portal/), listed after the 15 API guides, so an assistant can explain the portal as well as the API. When no key is configured the server instructions, hb_status and the missing-key error point to the first three.
Resource | What it covers |
| What the Healthier Business developer portal is, what is in it and the shortest path from a new account to a working integration. |
| Sign up for the developer console with your work email address, every field of the form, the rules for passwords and email addresses, and what each error message means. |
| What the Check your inbox page does, how long the confirmation link lasts, how to get another email and what to do when it does not arrive. |
| Signing in, resetting a forgotten password, turning on two-step sign-in with an authenticator app, recovery codes, and how sessions and lockouts behave. |
| A walk through the console: the sidebar, the getting started checklist, the account menu, the theme switch, and how it looks on a phone. |
| Create, rename, reset and delete sandboxes, read their addresses and numbers, and understand what a sandbox contains and what it never does. |
| Create test keys with the access you need, see a key once, roll and delete it, then exchange it for an access token and refresh it. |
| Make your first calls to a sandbox with curl, import the OpenAPI document or Postman collection, and use variables so the same requests work against production later. |
| Register an https endpoint in a sandbox, choose events, keep the signing secret, verify every signature, test and simulate events, read the delivery log, and understand retries and automatic switch-off. |
| Look at every table of a sandbox, search and sort it, and open a record as an expandable JSON tree. |
| Make the things only a person or a clock can do happen inside a sandbox, such as a candidate paying or an interview ending, and see the webhook events, emails and data changes they cause. |
| Build and send requests to a sandbox from the console, exchange a key for a token, save requests in collections, use variables, read responses, copy code in four languages and switch to live calls. |
| Read every call your sandbox answered, filter by method and result, open a call to see both bodies, and work out why a call failed using the error code and request id. |
| See the emails and texts a sandbox would have sent to candidates, search and filter them, and turn on notifications on your own device. |
| Ask the API team a question from the console, read their answers, choose what you need (including a paid technical support call paid with HB Pay), and what to put in a message so it is answered quickly. |
| The checklist for moving an integration from a sandbox to the live HB Hub, doing it by hand or connecting your HB Hub account to manage production keys and webhooks from the console. |
| Your name, time zone and password, the account security page, downloading your data and deleting your account. |
| A step by step migration from the per-service legacy APIs to the single Hub API v2: what changes, how to try it in a sandbox now, and how to switch to live when the Compliance Hub is released. |
| How the developer site is laid out, how to search it, what is on an endpoint page, how Try it works, and the tools around the reference (Ask AI, Copy for LLM, llms.txt, OpenAPI). |
| The limits that apply to keys and tokens, every error code and what to do about it, retry rules and how idempotency keys make repeated creates safe. |
| Short answers to the questions developers ask most, grouped by the part of the portal, with where to look when something does not work. |
Environment variables
Variable | Default | Meaning |
| none | The |
|
| Live by default. A sandbox looks like |
| detected |
|
|
|
|
| all | Comma list of portals (full mode, and a limit on |
|
|
|
|
|
|
|
| Must be |
|
|
|
|
| Cap on one tool answer. Larger answers are cut with a notice (lists lose items first). |
|
| Per request timeout. |
| none | Default secret for |
| the server's working directory | Comma-separated absolute folders |
| none | Bearer token required by |
|
| Defaults for |
CLI: hb-hub-mcp [--http [--port N] [--host H]] [--doctor] [--version] [--help].
Safety model
Rule | How |
Read-only by default | Every non-GET operation is refused with an explanation, and hidden in full mode. |
Writes need intent |
|
Live writes need two more things |
|
Nothing blind-retried | A write is never retried automatically. A dropped connection returns the |
Idempotency | Writes that support it get an |
Validation before sending | Path, query, headers and body are checked against the spec; a bad call sends nothing. |
Secrets | Key, tokens and webhook secrets are registered with a redactor that scrubs every tool answer and log line, even if the Hub echoes one. A webhook signing secret ( |
Health data | Operations flagged |
Size | Answers over |
Scope of tokens | One refresher per process (single-flight), the single-use refresh token is replaced the moment a new pair arrives, and the 10 a minute auth throttle and |
Credentials | Credential endpoints are not tools. |
Task tools | Same pipeline as |
Local files |
|
Money is integer pence with a currency; credits are units. The tool descriptions say which operations use credits.
Egress and the key's IP allowlist
With the default stdio transport the server runs on the developer's own machine, so every Hub call leaves from that machine's public IP. If the key has an IP allowlist, the developer's own address must be on it (or the call fails with 403 ip_not_allowed, and the error says what to do). With --http on a server, the server's address is what the Hub sees. Sandboxes do not enforce an allowlist unless switched on.
Troubleshooting
Symptom | Fix |
Server not listed, or exits at once | Run |
| Put the key in the client's server |
| Wrong, regenerated or deleted key, or a sandbox key against the live URL (or the other way round). |
| Add the named scope to the key on the Developer page ( |
| The machine running the server is not on the key's allowlist (see the egress note). |
| The account does not use that portal. |
| Use a real |
| Fix the fields listed under |
| Wait |
"read-only" refusals | By design. Enable in a sandbox with |
Too many tools in the client | Use compact mode (default) or |
Answer cut off | Use |
Available Tools
8 toolshb_call_operationARead-onlyIdempotent
[LIVE Hub] Call any Hub API v2 operation by id. Validates against the spec before sending; adds an Idempotency-Key to writes; follows pagination with all_pages (capped). The server is READ-ONLY: only GET operations run; writes are refused. Put path parameters in path_params, filters in query, JSON in body. Use fields (dotted paths such as ["candidate_ref","name"]) to keep answers small. Credits are units; money is integer pence with a currency. Never ask the user for an API key in chat.
| Name | Required | Description | Default |
|---|---|---|---|
| body | No | JSON request body (object). For file uploads use {"filename","content_base64","content_type"} for file fields. | |
| query | No | Query parameters, e.g. {"per_page":50,"search":"jane"}. | |
| fields | No | Keep only these dotted paths of each record in `data`. | |
| confirm | No | Live writes only: true after the user approved the plan. | |
| headers | No | Only headers the operation declares (e.g. Idempotency-Key). Authorization is never settable. | |
| all_pages | No | List operations: fetch following pages and merge data. | |
| max_pages | No | With all_pages: pages to fetch (default 5, max 20). | |
| path_params | No | Values for {placeholders} in the path, e.g. {"candidate_ref":"<uuid>"}. | |
| operation_id | Yes | Operation id from hb_search_operations, e.g. hub.candidates.list. | |
| idempotency_key | No | Reuse the key from a plan or an earlier unknown-outcome write to repeat it safely. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the annotations, the description discloses spec validation, idempotency-key handling, capped pagination behavior, the read-only server restriction, parameter placement rules, field projection, money/credit conventions, and API-key hygiene. Although the write-related language creates slight internal tension, it resolves explicitly to the read-only behavior declared by the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is dense but front-loaded, starting with purpose and then covering behavior and parameter guidance. It is appropriately sized for a complex dispatcher, though it mixes protocol behavior, safety constraints, and data conventions into one compact paragraph.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 10-parameter generic API dispatcher with no output schema, the description covers the essential invocation model, read-only behavior, pagination, and field reduction. It does not explain the return shape or error behavior, and it could more explicitly route the agent to hb_describe_operation before calling an unfamiliar operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the schema already documents each parameter. The description still adds useful cross-parameter context, including how path/query/body values map, dotted `fields` paths, and the convention that credits are units while money is integer pence with a currency.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Call any Hub API v2 operation by id.' It clearly distinguishes this generic dispatcher from sibling tools such as hb_search_operations and hb_describe_operation by making the operation id the central input.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives clear operational constraints: the server is read-only, only GET operations run, and writes are refused. It also explains where to put path parameters, filters, JSON body, and how to use fields/all_pages, but it does not explicitly name sibling alternatives such as hb_describe_operation for inspecting an operation first.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
hb_describe_eventARead-onlyIdempotent
Describe one webhook event: summary, delivery behaviour (retries), the data payload schema and a sample payload. Payloads hold ids, statuses, dates and a candidate_ref, never names, emails or health data. Knowledge only.
| Name | Required | Description | Default |
|---|---|---|---|
| event_type | Yes | e.g. occupational-health.request.submitted |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly, idempotent, non-destructive and closed-world, so the safety profile is covered. The description adds genuinely new behavioural context: retries are part of the delivery explanation, and the payload is explicitly privacy-scrubbed (ids, statuses, dates, candidate_ref; never names, emails or health data), which tells an agent it can safely surface this output.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences, front-loaded with the verb and resource, then the return contents, then the privacy constraint and the 'knowledge only' qualifier. No filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema exists, so the description must carry return-value information — and it does, naming all four return components plus the payload field categories. For a one-parameter read tool with rich annotations, nothing an agent needs is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There is a single required parameter at 100% schema coverage, with the schema itself supplying the example form 'occupational-health.request.submitted'. The description adds no further naming convention, wildcard or nesting rules, so it sits at the baseline for a fully documented schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Specific verb+resource ('Describe one webhook event') with an enumerated account of what the description returns: summary, retry behaviour, payload schema, sample payload. The singular 'one' implicitly separates it from the sibling hb_list_events, which enumerates many.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The trailing 'Knowledge only.' signals this is static reference information rather than live data, which is useful, but the description never states when to reach for it versus hb_list_events or hb_describe_operation, nor any prerequisite such as obtaining the event_type first.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
hb_describe_operationARead-onlyIdempotent
Full detail of one operation: parameters, body schema with required fields and an example, required scope, side effects (credits, health data, destructive, idempotency), documented errors, and a ready example call for hb_call_operation. Read this before any write.
| Name | Required | Description | Default |
|---|---|---|---|
| operation_id | Yes | e.g. hub.candidates.list |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover safety (readOnly, idempotent, non-destructive), and with no output schema the description does real work by disclosing that side effects (credits, health data, destructive, idempotency) and documented errors are returned. It doesn't state pagination, size limits, or behavior for invalid operation_ids, keeping it out of the top band.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single dense but well-ordered sentence that front-loads the return contents and closes with the actionable directive 'Read this before any write.' No filler, though the enumerated list is long enough to border on a run-on.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description must explain what comes back, and it does so exhaustively: parameters, body schema with required fields and an example, required scope, side effects, errors, and a ready-to-use call. Nothing an agent needs before invoking it is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the single operation_id parameter already carries an example ('hub.candidates.list'); the description adds no further semantics about the identifier format or lookup behavior beyond referencing the example call. Baseline 3 applies when the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb/resource ('Full detail of one operation') and enumerates exactly what it returns, which cleanly separates it from hb_search_operations (find operations) and hb_call_operation (execute one). An agent can pick this without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'Read this before any write' gives a clear directive on when to invoke it and implicitly positions it as the precursor to hb_call_operation. It stops short of naming explicit alternatives or when-not-to-use conditions, so it's strong but not exhaustive.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
hb_list_eventsARead-onlyIdempotent
List the 59 webhook events Hub can send (type and one-line summary). Optionally filter by portal prefix (e.g. "occupational-health") or text. Knowledge only: sends nothing.
| Name | Required | Description | Default |
|---|---|---|---|
| query | No | Text to match in the event type or summary. | |
| portal | No | Portal prefix, e.g. occupational-health, practical-training, hub. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotations already declare readOnlyHint, idempotentHint, destructiveHint=false, and openWorldHint=false, so 'sends nothing' largely repeats that structured signal. The description does add value by stating the return payload shape (type and one-line summary), which no output schema provides. However, it says nothing about ordering, completeness guarantees, or what happens when filters match nothing.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, front-loaded with what the tool returns, followed by the optional filters and the safety note. Every sentence adds information, and there is no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-required-parameter, no-output-schema listing tool, the description covers the return shape, the filter behavior, and the read-only nature, which is enough for correct invocation. The main missing piece is disambiguation from hb_describe_event, which the description should include but currently leaves out.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so both parameters are already documented, which sets the baseline at 3. The description repeats the portal example and adds the notion of matching against 'type or summary' for the text filter, which slightly enriches the schema wording but does not go beyond it.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Specific verb (List) plus resource (webhook events Hub can send), with the scope quantified (59) and the return shape named (type + one-line summary). It is clear on its own, but it does not distinguish itself from the sibling hb_describe_event, which covers the same resource space.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The sentence about optional filtering implies the browse-vs-filter workflow, and 'Knowledge only: sends nothing' clarifies that this is a discovery call. However, there is no explicit guidance on when to call this tool versus hb_describe_event, and no prerequisites or exclusions are stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
hb_search_guidesARead-onlyIdempotent
Search the bundled guides by words and get the best matches with a snippet and the resource to read (hb://guides/). Covers the Hub API v2 developer guides and the developer portal guides (sign up, sandboxes, keys, webhooks, Playground, going to production). Knowledge only: sends nothing, needs no key.
| Name | Required | Description | Default |
|---|---|---|---|
| group | No | "api" = Hub API guides, "portal" = developer portal (console) guides. Default all. | |
| limit | No | Max results (default 5, max 20). | |
| query | Yes | Words to look for, e.g. "create sandbox", "rotate webhook secret", "idempotency key". |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly/idempotent/closed-world, and the description reinforces with "sends nothing, needs no key" plus a concrete return format (snippet + resource URI) that annotations cannot convey. It doesn't state ranking behavior or what happens on zero matches, but the value-add over annotations is real.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the action and result, followed by scope and the knowledge-only constraint. No filler or restatement of the name.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description supplies the return format and the follow-up resource URI, and it clarifies the closed-world knowledge-only nature. An agent has everything needed to decide to call it and to act on results.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with an enum description for group and defaults/max for limit, so the schema already does the work. The description adds only the loose "by words" hint and example-style phrasing implied by the query schema, nothing beyond it.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource (search bundled guides) and names the return shape (best matches, snippet, and the hb://guides/<name> resource). It also enumerates the covered content (Hub API v2 and developer portal guides), which separates it from the sibling hb_search_operations tool that indexes operations rather than prose guides.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
"Knowledge only: sends nothing, needs no key" clearly frames this as the read-only lookup path for conceptual questions, distinguishing it from the call/operation tools. It stops short of explicitly saying when not to use it (e.g. use hb_describe_operation for exact request schemas).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
hb_search_operationsARead-onlyIdempotent
Search the 189 Hub API v2 operations by text, toolset (portal), method or scope. Returns id, method, path, summary, scope, flags (credits, health data, destructive) and whether each is callable now. Start here, then hb_describe_operation, then hb_call_operation.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Max results (default 20, max 50). | |
| query | No | Words to look for, e.g. "book practical training", "candidate compliance", "webhook". | |
| scope | No | Substring of the required scope, e.g. "bookings:write". | |
| method | No | ||
| toolset | No | Portal: hub, account, online-training, occupational-health, references, practical-training, virtual-bls-training, clinical-interviews, registration-monitoring, dbs-rtw, clinical-appraisals, authentication. | |
| writes_only | No | Only operations that change data. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint and destructiveHint=false, so the description does not have to explain safety. It adds real value beyond that: what fields come back (id, method, path, summary, scope, flags, callable-now) and the fact that per-operation flags include credits, health data and destructive markers. It does not discuss result cap behavior or pagination beyond what the schema says.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, zero filler. Capability, return shape and the intended call sequence are all front-loaded in that order.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema, so the description compensates by enumerating the returned fields and the callable-now signal. Combined with a well-described 6-parameter schema and clear annotations, an agent has everything needed to call it and act on the results.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 83%, so the schema already carries most parameter meaning and a 3 would be the baseline. The description still maps its searchable facets directly onto the parameters (query, toolset, method, scope), reinforcing how each narrows the search, which adds modest value over the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Search the 189 Hub API v2 operations') plus the exact facets it searches over (text, toolset, method, scope). A reader immediately distinguishes it from hb_describe_operation and hb_call_operation, which the description also names.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives an explicit workflow: 'Start here, then hb_describe_operation, then hb_call_operation,' which tells the agent the correct entry point and ordering. It stops short of exclusions (e.g. when to prefer hb_list_events or hb_search_guides), so it is strong but not fully exhaustive.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
hb_statusARead-onlyIdempotent
Who am I and what may I do? Calls GET /auth/me and reports: environment (live or sandbox), base URL, key name and prefix, the key's scopes, whether writes are enabled, the toolsets, and the last-seen rate limit. Never reveals a key or token. Call this first.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and destructiveHint=false, and the description adds meaningful context: it reports environment, base URL, key scopes, write enablement, toolsets, and rate limit. "Never reveals a key or token" is a useful safety disclosure beyond the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and front-loaded with the core question, followed by a precise list of reported fields. Every sentence earns its place, and the final "Call this first" instruction is clear and actionable.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema, so the description carries the burden of explaining return values, and it does so thoroughly. For a parameterless diagnostic tool, it provides enough detail for an agent to understand what will be returned and when to call it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so there are no parameter semantics to explain. The description appropriately avoids inventing inputs and focuses on behavior and returned information.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific purpose: reporting caller identity and permissions via GET /auth/me. It distinguishes this diagnostic tool from the sibling operation, event, guide, and webhook tools by explaining exactly what status information it returns.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
"Call this first" gives explicit ordering guidance for using this tool before others. It does not discuss when not to use it, but for an identity/status tool with no parameters that scenario is less relevant.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
hb_verify_webhook_signatureARead-onlyIdempotent
Pure local helper (no network): verify or compute a Hub webhook signature. The signature is "sha256=" plus the hex HMAC-SHA256 of "{timestamp}.{raw body}" with the endpoint secret; deliveries older or newer than 300 seconds are rejected. Pass the raw body byte-for-byte. The secret is read from HB_WEBHOOK_SECRET unless passed (prefer a sandbox secret if you pass it in chat). Omit signature to just compute it.
| Name | Required | Description | Default |
|---|---|---|---|
| body | Yes | The raw request body exactly as received. | |
| secret | No | Endpoint signing secret. Defaults to env HB_WEBHOOK_SECRET. | |
| signature | No | The X-Hub-Signature header. Omit to compute the expected signature. | |
| timestamp | Yes | The X-Hub-Timestamp header (epoch seconds). | |
| now_epoch_seconds | No | Override the current time (for testing recorded deliveries). | |
| tolerance_seconds | No | Replay window; default 300. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover safety (readOnly, idempotent, non-destructive, closed-world), yet the description adds substantial behavior beyond them: the exact signing algorithm, the 300-second replay rejection window, the byte-for-byte raw-body requirement, the HB_WEBHOOK_SECRET env fallback, and a secret-handling caution. These are exactly the facts an agent needs to call it correctly and none are in the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Five short sentences, front-loaded with the single most decision-relevant fact (local, no network), then the algorithm, then the mode switch. There is mild overlap between "300 seconds" and `tolerance_seconds`'s default, but it is justified because it also states the rejection behavior.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description carries the return-value burden and only half covers it: it implies compute returns the signature string, but never says what verify returns (boolean, error, mismatch detail). Everything else an agent needs — inputs, algorithm, replay policy, secret source — is present.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3, but the description adds meaning the schema does not: that `signature` being omitted flips the tool into compute mode, that `secret` falls back to an environment variable, and that `body` must be passed byte-for-byte rather than parsed. Only `now_epoch_seconds` and `tolerance_seconds` are left purely to the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Opens with a specific verb pair and resource: "verify or compute a Hub webhook signature", and immediately distinguishes itself from every sibling by declaring "Pure local helper (no network)" — the siblings are all remote API tools. An agent can classify this tool without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly gives the mode switch ("Omit `signature` to just compute it") and a situational recommendation ("prefer a sandbox secret if you pass it in chat"). It doesn't name a when-not-to-use case or an alternative tool, but none of the siblings overlap, so there is little left ambiguous.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
8 tool updates
v0.1.3- First observed
hb_call_operation - First observed
hb_describe_event - First observed
hb_describe_operation - First observed
hb_list_events - First observed
hb_search_guides - First observed
hb_search_operations - First observed
hb_status - First observed
hb_verify_webhook_signature
TDQS
Scored across 8 tools
Each tool targets a distinct resource+action: auth introspection (hb_status), operation discovery (search/describe/call), webhook event discovery (list/describe), a local signature helper, and guide search. The search/describe/call trio is a classic progressive-disclosure pattern with explicitly stated ordering, so there is no realistic misselection. The only near-collision, hb_search_operations vs hb_search_guides, is cleanly separated by domain (API operations vs documentation).
All eight tools share the hb_ prefix and snake_case, and follow a predictable verb_noun pattern (search_operations, describe_operation, call_operation, list_events, describe_event, verify_webhook_signature, search_guides). hb_status is the sole noun-only name, but it is a conventional whoami alias and does not break the pattern meaningfully.
Eight tools is well within the sweet spot and each one earns its place: three for the operation lifecycle, two for webhook events, one local crypto helper, one knowledge search, one status check. The meta-tool design (search -> describe -> call) means a small surface covers 189 API operations without bloat.
The search/describe/call pattern gives effectively complete coverage of the 189-operation API surface, and webhook discovery plus signature verification covers the integration lifecycle. Minor gaps: no tool to read a guide's full content (hb_search_guides returns an hb:// resource reference, relying on MCP resources), and no webhook endpoint registration/management operations. The read-only refusal of writes is a documented server constraint rather than a surface gap.
Maintenance
Related MCP Connectors
Find and call verified APIs from any AI assistant, with free trial calls and previewed writes.
Connect AI to store orders, products and inventory with scoped access and human approvals.
- mcpOAuthcom.vibgrate
Query your team's drift, vulnerability, and upgrade data from any AI assistant. OAuth 2.1, 51 tools.
Connect AI agents to 580+ APIs with OAuth or API-key auth. Hosted gateway; API pricing varies.
Related MCP Servers
- AlicenseAqualityDmaintenanceEnables AI assistants to interact with SMB platform APIs for querying business data, managing tasks, accessing connectors, dashboards, and monitoring security.16MIT
- AlicenseNot gradedqualityDmaintenanceEnables AI assistants to interact with Basecamp projects, messages, to-dos, and Card Tables, with read-only access by default and write operations requiring explicit approval.MIT
- AlicenseNot gradedqualityBmaintenanceEnables AI assistants to securely connect to a vybeflow tenant for multi-channel messaging operations such as reading inbox tickets, looking up contacts, checking campaign progress, and sending messages under scoped permissions.MIT
- AlicenseNot gradedqualityAmaintenanceEnables AI agents to securely access and manage CRM pipeline, relationships, tasks, notes, files, and deal context through authenticated Streamable HTTP/OAuth, inheriting the signed-in user's permissions and business-unit isolation.1MIT