Skip to main content
Glama
Boneyard Integration Starter

Boneyard Integration Starter

by a-mart

Boneyard integration starter

Build an MCP server that plugs into Boneyard as a connection, without changing Boneyard. This repository contains:

  • The contract: docs/contract.md. Language-agnostic rules for authentication, caller context, tool naming and annotations, errors and limits.

  • A reference server in TypeScript (Node 22, official MCP SDK, stateless Streamable HTTP). Its example tools are tickets_search (read), ticket_add_comment (write) and ticket_wait_for_update (a wait tool for long work), backed by an in-repository fake. A second endpoint, /mcp-tasks, serves tickets_export as an MCP task. See long-running.md.

  • The kit: kit check, a conformance suite you can run against any server URL, and kit dev, a mock Boneyard gateway for trying tools as a given agent, person and channel.

Coding agents: start with AGENTS.md. To build your own server, follow Building a new server and the Replace the example checklist, which lists every file that mentions the ticket example. The kit and its tests don't depend on the example, so they keep passing when you delete it.

Quick start

npm ci
npm run verify      # typecheck, standards, tests, and a full conformance run against the reference server
npm run dev         # serve http://127.0.0.1:8750/mcp with the fake backend
npm run kit:dev     # in a second terminal: call tools as Boneyard would

Check any server, including one in another language:

npm run kit -- check https://your-server.example.com/mcp --token-file ./connection-token

Related MCP server: FindMyClient MCP Server

Documentation

Page

For

contract.md

What your server must do (any language)

long-running.md

Long jobs: how Boneyard follow-ups wait (wait tools, MCP Tasks, retries)

concepts.md

Connections vs integrations, Off, Ask and Allow, what the admin sees

backends.md

Backends without an API key (file shares, mounted folders), fixture roots, canaries, admin configuration

security.md

Secrets, least privilege, containment, prompt injection, audit, regulated data

testing.md

npm test, kit check (safe and fake modes), kit dev

deploying.md

Same host (Docker network), elsewhere over HTTPS, Windows service, file shares

registering.md

Adding the connection in Boneyard

server-json.md

Describing your headers so Boneyard renders a form

Configuration (reference server)

Variable

Default

Meaning

CONNECTION_TOKEN_FILE / CONNECTION_TOKEN

required

Token Boneyard sends as Authorization: Bearer ... (at least 32 characters)

BACKEND_API_KEY_FILE / BACKEND_API_KEY

required

Credential for the backend (the fake checks it too)

BACKEND

fake

Backend implementation

TRUST_CALLER_CONTEXT

false

Use Boneyard-* headers for attribution and logs

HOST / PORT / MCP_PATH

127.0.0.1 / 8750 / /mcp

Listener

MCP_TASKS_PATH

/mcp-tasks

Endpoint for task tools (protocol 2025-11-25); register it as its own connection

FAKE_EXPORT_DELAY_MS

5000

How long the fake backend takes to export tickets

MAX_RESULT_BYTES

65536

Result bound per tool call (at most 262144)

MAX_BODY_BYTES

1048576

Request body cap

ALLOWED_ORIGINS

empty

Browser origins allowed (the gateway sends none)

LOG_LEVEL

info

debug, info, warn or error

License

MIT. See LICENSE.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

    Related MCP Connectors

    Related MCP Servers

    • F
      license
      Not graded
      quality
      B
      maintenance
      Enables users to run lead searches, poll asynchronous jobs, retrieve enriched and scored leads, and perform search-and-wait workflows through MCP tools that accept each caller's own API token per call. It supports remote streamable-http use, allowing safe sharing without server-side shared credentials.
      -
    • F
      license
      A
      quality
      B
      maintenance
      Enables read-only lookup of support tickets and ticket lists through two tools, returning only bounded fields like ID, status, title and note. Tenant filtering and argument validation confine every read to the configured organization, with denied access and upstream failures surfaced as explicit results.
      2
      -
    • A
      license
      Not graded
      quality
      B
      maintenance
      Enables AI assistants to connect over streamable HTTP with bearer authentication to tools for agent lifecycle, email, phone, platform, vault, and browser extension management.
      2
      MIT