Hub MCP server
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| HB_ENV | No | live or sandbox: overrides environment detection. An unrecognised host is treated as live. | |
| HB_API_KEY | Yes | The hbk_ API key. Environment only; never a tool argument. | |
| HB_BASE_URL | No | Hub API base URL. Live by default. A sandbox looks like https://<portal host>/sandbox/<uuid>. http is allowed only for localhost. | https://hub.hbcompliance.co.uk |
| HB_TOOLSETS | No | Comma list of portals to expose in full mode, and a limit on hb_call_operation. | |
| HB_LOG_LEVEL | No | Log level: silent, error, warn, info, or debug. Logs go to stderr and hold metadata only. | warn |
| HB_READ_ONLY | No | false enables writes. Defaults to true. | true |
| HB_TOOL_MODE | No | compact (8 tools) or full (one tool per operation). | compact |
| HB_MCP_HTTP_HOST | No | Default host for --http. | 127.0.0.1 |
| HB_MCP_HTTP_PORT | No | Default port for --http. | 3333 |
| HB_MCP_HTTP_TOKEN | No | Bearer token required by --http when not bound to loopback. | |
| HB_WEBHOOK_SECRET | No | Default secret for hb_verify_webhook_signature. | |
| HB_ALLOW_LIVE_WRITES | No | Must be true, together with HB_READ_ONLY=false, to write to the live Hub. | false |
| HB_MAX_RESPONSE_CHARS | No | Cap on one tool answer; larger answers are truncated with a notice. | 60000 |
| HB_REQUEST_TIMEOUT_MS | No | Per request timeout in milliseconds. | 30000 |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {} |
| resources | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| hb_statusA | Who am I and what may I do? Calls GET /auth/me and reports: environment (live or sandbox), base URL, key name and prefix, the key's scopes, whether writes are enabled, the toolsets, and the last-seen rate limit. Never reveals a key or token. Call this first. |
| hb_search_operationsA | Search the 189 Hub API v2 operations by text, toolset (portal), method or scope. Returns id, method, path, summary, scope, flags (credits, health data, destructive) and whether each is callable now. Start here, then hb_describe_operation, then hb_call_operation. |
| hb_describe_operationA | Full detail of one operation: parameters, body schema with required fields and an example, required scope, side effects (credits, health data, destructive, idempotency), documented errors, and a ready example call for hb_call_operation. Read this before any write. |
| hb_call_operationA | [LIVE Hub] Call any Hub API v2 operation by id. Validates against the spec before sending; adds an Idempotency-Key to writes; follows pagination with all_pages (capped). The server is READ-ONLY: only GET operations run; writes are refused. Put path parameters in path_params, filters in query, JSON in body. Use |
| hb_list_eventsA | List the 59 webhook events Hub can send (type and one-line summary). Optionally filter by portal prefix (e.g. "occupational-health") or text. Knowledge only: sends nothing. |
| hb_describe_eventA | Describe one webhook event: summary, delivery behaviour (retries), the |
| hb_verify_webhook_signatureA | Pure local helper (no network): verify or compute a Hub webhook signature. The signature is "sha256=" plus the hex HMAC-SHA256 of "{timestamp}.{raw body}" with the endpoint secret; deliveries older or newer than 300 seconds are rejected. Pass the raw body byte-for-byte. The secret is read from HB_WEBHOOK_SECRET unless passed (prefer a sandbox secret if you pass it in chat). Omit |
| hb_search_guidesA | Search the bundled guides by words and get the best matches with a snippet and the resource to read (hb://guides/). Covers the Hub API v2 developer guides and the developer portal guides (sign up, sandboxes, keys, webhooks, Playground, going to production). Knowledge only: sends nothing, needs no key. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
| book-practical-training | Find the candidate, a course, a session with free places, check credits, then book (with a plan first in live). |
| check-candidate-compliance | Read-only: gather a candidate's compliance status across Hub, Occupational Health and Online Training. |
| webhook-sandbox-setup | Register a webhook endpoint in a SANDBOX, choose events, send a test event, check deliveries and verify signatures. |
| get-started-in-sandbox | Walk a new developer from sign-up to a first read call: work email, verify, sandbox, API key, HB_BASE_URL/HB_API_KEY, --doctor, first read. |
| go-live-checklist | Walk through moving an integration from a sandbox to the live Hub. |
| onboard-candidate | Check for duplicates, then create a candidate (plan first in live). |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
| overview | Counts, toolsets and an index of every operation. |
| guide-getting-started | Hub API v2 developer guide (getting-started). |
| guide-authentication | Hub API v2 developer guide (authentication). |
| guide-candidates-and-candidate-ref | Hub API v2 developer guide (candidates-and-candidate-ref). |
| guide-scopes-and-permissions | Hub API v2 developer guide (scopes-and-permissions). |
| guide-ip-allowlisting | Hub API v2 developer guide (ip-allowlisting). |
| guide-pagination-filtering-sorting | Hub API v2 developer guide (pagination-filtering-sorting). |
| guide-idempotency | Hub API v2 developer guide (idempotency). |
| guide-errors | Hub API v2 developer guide (errors). |
| guide-rate-limits | Hub API v2 developer guide (rate-limits). |
| guide-webhooks | Hub API v2 developer guide (webhooks). |
| guide-health-data-and-privacy | Hub API v2 developer guide (health-data-and-privacy). |
| guide-testing-and-sandbox | Hub API v2 developer guide (testing-and-sandbox). |
| guide-going-live | Hub API v2 developer guide (going-live). |
| guide-changelog-and-versioning | Hub API v2 developer guide (changelog-and-versioning). |
| guide-sdk-and-tools | Hub API v2 developer guide (sdk-and-tools). |
| guide-portal-overview | Developer portal guide: What the Healthier Business developer portal is, what is in it and the shortest path from a new account to a working integration. |
| guide-portal-create-your-account | Developer portal guide: Sign up for the developer console with your work email address, every field of the form, the rules for passwords and email addresses, and what each error message means. |
| guide-portal-verify-your-email | Developer portal guide: What the Check your inbox page does, how long the confirmation link lasts, how to get another email and what to do when it does not arrive. |
| guide-portal-sign-in-and-security | Developer portal guide: Signing in, resetting a forgotten password, turning on two-step sign-in with an authenticator app, recovery codes, and how sessions and lockouts behave. |
| guide-portal-the-console-tour | Developer portal guide: A walk through the console: the sidebar, the getting started checklist, the account menu, the theme switch, and how it looks on a phone. |
| guide-portal-sandboxes | Developer portal guide: Create, rename, reset and delete sandboxes, read their addresses and numbers, and understand what a sandbox contains and what it never does. |
| guide-portal-api-keys-and-tokens | Developer portal guide: Create test keys with the access you need, see a key once, roll and delete it, then exchange it for an access token and refresh it. |
| guide-portal-calling-the-api-from-curl-and-postman | Developer portal guide: Make your first calls to a sandbox with curl, import the OpenAPI document or Postman collection, and use variables so the same requests work against production later. |
| guide-portal-webhooks | Developer portal guide: Register an https endpoint in a sandbox, choose events, keep the signing secret, verify every signature, test and simulate events, read the delivery log, and understand retries and automatic switch-off. |
| guide-portal-data-page-and-json-viewer | Developer portal guide: Look at every table of a sandbox, search and sort it, and open a record as an expandable JSON tree. |
| guide-portal-simulate | Developer portal guide: Make the things only a person or a clock can do happen inside a sandbox, such as a candidate paying or an interview ending, and see the webhook events, emails and data changes they cause. |
| guide-portal-api-playground | Developer portal guide: Build and send requests to a sandbox from the console, exchange a key for a token, save requests in collections, use variables, read responses, copy code in four languages and switch to live calls. |
| guide-portal-request-log-and-debugging | Developer portal guide: Read every call your sandbox answered, filter by method and result, open a call to see both bodies, and work out why a call failed using the error code and request id. |
| guide-portal-inbox-and-notifications | Developer portal guide: See the emails and texts a sandbox would have sent to candidates, search and filter them, and turn on notifications on your own device. |
| guide-portal-support-and-booking-a-call | Developer portal guide: Ask the API team a question from the console, read their answers, choose what you need (including a paid technical support call paid with HB Pay), and what to put in a message so it is answered quickly. |
| guide-portal-go-to-production | Developer portal guide: The checklist for moving an integration from a sandbox to the live HB Hub, doing it by hand or connecting your HB Hub account to manage production keys and webhooks from the console. |
| guide-portal-profile-and-security | Developer portal guide: Your name, time zone and password, the account security page, downloading your data and deleting your account. |
| guide-portal-moving-from-legacy-apis-to-v2 | Developer portal guide: A step by step migration from the per-service legacy APIs to the single Hub API v2: what changes, how to try it in a sandbox now, and how to switch to live when the Compliance Hub is released. |
| guide-portal-reading-the-api-reference | Developer portal guide: How the developer site is laid out, how to search it, what is on an endpoint page, how Try it works, and the tools around the reference (Ask AI, Copy for LLM, llms.txt, OpenAPI). |
| guide-portal-rate-limits-errors-and-idempotency | Developer portal guide: The limits that apply to keys and tokens, every error code and what to do about it, retry rules and how idempotency keys make repeated creates safe. |
| guide-portal-faq-and-troubleshooting | Developer portal guide: Short answers to the questions developers ask most, grouped by the part of the portal, with where to look when something does not work. |
| portal-account | What the account portal API does and its operations. |
| portal-authentication | What the authentication portal API does and its operations. |
| portal-clinical-appraisals | What the clinical-appraisals portal API does and its operations. |
| portal-clinical-interviews | What the clinical-interviews portal API does and its operations. |
| portal-dbs-rtw | What the dbs-rtw portal API does and its operations. |
| portal-hub | What the hub portal API does and its operations. |
| portal-occupational-health | What the occupational-health portal API does and its operations. |
| portal-online-training | What the online-training portal API does and its operations. |
| portal-practical-training | What the practical-training portal API does and its operations. |
| portal-references | What the references portal API does and its operations. |
| portal-registration-monitoring | What the registration-monitoring portal API does and its operations. |
| portal-virtual-bls-training | What the virtual-bls-training portal API does and its operations. |
TDQS
Scored across 8 tools
Each tool targets a distinct resource+action: auth introspection (hb_status), operation discovery (search/describe/call), webhook event discovery (list/describe), a local signature helper, and guide search. The search/describe/call trio is a classic progressive-disclosure pattern with explicitly stated ordering, so there is no realistic misselection. The only near-collision, hb_search_operations vs hb_search_guides, is cleanly separated by domain (API operations vs documentation).
All eight tools share the hb_ prefix and snake_case, and follow a predictable verb_noun pattern (search_operations, describe_operation, call_operation, list_events, describe_event, verify_webhook_signature, search_guides). hb_status is the sole noun-only name, but it is a conventional whoami alias and does not break the pattern meaningfully.
Eight tools is well within the sweet spot and each one earns its place: three for the operation lifecycle, two for webhook events, one local crypto helper, one knowledge search, one status check. The meta-tool design (search -> describe -> call) means a small surface covers 189 API operations without bloat.
The search/describe/call pattern gives effectively complete coverage of the 189-operation API surface, and webhook discovery plus signature verification covers the integration lifecycle. Minor gaps: no tool to read a guide's full content (hb_search_guides returns an hb:// resource reference, relying on MCP resources), and no webhook endpoint registration/management operations. The read-only refusal of writes is a documented server constraint rather than a surface gap.