Codinfy MCP
<div align="center">
<img src="assets/codinfy-brand/ICON.png" alt="Codinfy" width="96" />
# `@codinfy/mcp`
### The official Codinfy public MCP server
Connect any AI agent — **Claude Code/Desktop, Cursor, Codex, Continue, Cline, Windsurf** — to the Codinfy platform: validate licenses, check updates, browse the marketplace catalog and fetch the official design tokens.
[](https://www.npmjs.com/package/@codinfy/mcp)
[](LICENSE)
[](https://nodejs.org)
[](https://modelcontextprotocol.io)
**📦 [npm](https://www.npmjs.com/package/@codinfy/mcp) · 🌐 [codinfy.com](https://codinfy.com) · 📚 [docs.codinfy.com/mcp](https://docs.codinfy.com/mcp) · 🛡️ [Security](SECURITY.md)**
**🇬🇧 English** · [🇫🇷 Français](README.fr.md)
</div>
---
## Status
**v0.2.0** — 10 tools live, every one backed by a real shipped Codinfy API
(no stubs, ever). Payments, OAuth (Login with Codinfy) and Ads tools ship
together with their platform APIs.
## Quick start
```bash
# Claude Code
claude mcp add codinfy -e CODINFY_LICENSE_SECRET=xxx -- npx -y @codinfy/mcp
```
Configs for Claude Desktop, Cursor, Codex, Continue and Cline:
[`examples/`](examples/). Full guide: [`docs/getting-started.md`](docs/getting-started.md).
## Tools
| Category | Tools |
|---|---|
| **Licenses** (HMAC-signed) | `codinfy_validate_license` · `codinfy_check_license_status` · `codinfy_get_grace_period` · `codinfy_check_license_update` |
| **Catalog** | `codinfy_list_products` · `codinfy_get_product` · `codinfy_search_products` |
| **Platform** | `codinfy_get_design_tokens` · `codinfy_health` · `codinfy_get_integration_links` |
Details: [`docs/api-reference.md`](docs/api-reference.md) ·
problems: [`docs/troubleshooting.md`](docs/troubleshooting.md).
## Environment
| Variable | Required | Purpose |
|---|---|---|
| `CODINFY_LICENSE_SECRET` | license tools only | HMAC secret delivered with your license — **never commit it** |
| `CODINFY_API_BASE` | no | default `https://api.codinfy.com/api` |
| `CODINFY_SITE_BASE` | no | default `https://codinfy.com` |
| `CODINFY_API_KEY` | no | `pk_live_…` forwarded as `X-Codinfy-Api-Key`; key issuance arrives with the developer portal |
## Security model
- Requests to the License API are signed **HMAC-SHA256 over the raw body**
with an anti-replay timestamp (±300 s) — the same wire contract as the
official PHP and Node SDKs (cross-language test vector in `tests/`).
- Responses carry an **RS256 JWT**: verify it locally in your script (see
the [anti-tampering guide](https://github.com/bakalagoin/codinfy/blob/main/docs/sdk/INTEGRATION_GUIDE.md)).
- `X-RateLimit-*` headers are relayed in every tool result so agents can
self-throttle (60 req/min/IP).
- This public server never exposes internal Codinfy tooling (rule R15).
## Development
```bash
npm install
npm test # vitest — includes the PHP cross-language HMAC vector
npm run build # tsc → dist/
node dist/index.js # stdio server, "ready on stdio (10 tools)"
```
## 🌍 Connect with us
| Network | Codinfy | Bakala Goin (Founder & CEO) |
|---|---|---|
| **Facebook** | [@codinfyci](https://facebook.com/codinfyci) | [@bakalagoin](https://facebook.com/bakalagoin) |
| **Instagram** | [@codinfyci](https://instagram.com/codinfyci) | [@bakalagoin](https://instagram.com/bakalagoin) |
| **LinkedIn** | [company/codinfyen](https://linkedin.com/company/codinfyen/) | [bakala-goin](https://www.linkedin.com/in/bakala-goin-66428b247) |
| **TikTok** | — | [@bakalagoin](https://www.tiktok.com/@bakalagoin) |
| **X (Twitter)** | — | [@bakalagoin](https://twitter.com/bakalagoin) |
## License
[MIT](LICENSE) © 2026 **RAFLOX SAS** — Codinfy, Abidjan, Côte d'Ivoire.
---
<div align="center">
**Codinfy** — by **RAFLOX SAS** · 📧 [contact@codinfy.com](mailto:contact@codinfy.com) · 🌐 [codinfy.com](https://codinfy.com)
<sub>Part of the Codinfy MCP ecosystem · <a href="https://github.com/bakalagoin/codix-build-mcp">codix-build-mcp</a></sub>
</div>
TDQS
Scored across 17 tools
All 17 tools have clearly distinct purposes. Each targets a specific resource and action (e.g., license validation vs. status check, brand assets vs. settings). There is no overlap that would confuse an agent.
All tools use a consistent verb_noun snake_case pattern (e.g., create_checkout, get_product, list_ad_units). Even OAuth tools follow this implicitly. No mixing of conventions.
17 tools cover multiple subdomains (licensing, payments, ads, branding, marketplace, auth, analytics). While slightly above the typical 15-tool threshold, each tool serves a distinct need and the count is justified for the platform's breadth.
The tool surface covers key read operations and essential writes (checkout creation, event tracking) across all subdomains. Minor gaps exist (e.g., no product creation or license revocation), but for a client-facing API these are acceptable and do not hinder common workflows.