Skip to main content
Glama
README.md
<div align="center">

<img src="assets/codinfy-brand/ICON.png" alt="Codinfy" width="96" />

# `@codinfy/mcp`

### The official Codinfy public MCP server

Connect any AI agent — **Claude Code/Desktop, Cursor, Codex, Continue, Cline, Windsurf** — to the Codinfy platform: validate licenses, check updates, browse the marketplace catalog and fetch the official design tokens.

[![npm version](https://img.shields.io/npm/v/@codinfy/mcp.svg?color=FF7900)](https://www.npmjs.com/package/@codinfy/mcp)
[![License: MIT](https://img.shields.io/badge/License-MIT-34BB78.svg)](LICENSE)
[![Node](https://img.shields.io/badge/node-%E2%89%A518-339933?logo=node.js&logoColor=white)](https://nodejs.org)
[![MCP](https://img.shields.io/badge/Model_Context_Protocol-compatible-2563EB)](https://modelcontextprotocol.io)

**📦 [npm](https://www.npmjs.com/package/@codinfy/mcp) · 🌐 [codinfy.com](https://codinfy.com) · 📚 [docs.codinfy.com/mcp](https://docs.codinfy.com/mcp) · 🛡️ [Security](SECURITY.md)**

**🇬🇧 English** · [🇫🇷 Français](README.fr.md)

</div>

---

## Status

**v0.2.0** — 10 tools live, every one backed by a real shipped Codinfy API
(no stubs, ever). Payments, OAuth (Login with Codinfy) and Ads tools ship
together with their platform APIs.

## Quick start

```bash
# Claude Code
claude mcp add codinfy -e CODINFY_LICENSE_SECRET=xxx -- npx -y @codinfy/mcp
```

Configs for Claude Desktop, Cursor, Codex, Continue and Cline:
[`examples/`](examples/). Full guide: [`docs/getting-started.md`](docs/getting-started.md).

## Tools

| Category | Tools |
|---|---|
| **Licenses** (HMAC-signed) | `codinfy_validate_license` · `codinfy_check_license_status` · `codinfy_get_grace_period` · `codinfy_check_license_update` |
| **Catalog** | `codinfy_list_products` · `codinfy_get_product` · `codinfy_search_products` |
| **Platform** | `codinfy_get_design_tokens` · `codinfy_health` · `codinfy_get_integration_links` |

Details: [`docs/api-reference.md`](docs/api-reference.md) ·
problems: [`docs/troubleshooting.md`](docs/troubleshooting.md).

## Environment

| Variable | Required | Purpose |
|---|---|---|
| `CODINFY_LICENSE_SECRET` | license tools only | HMAC secret delivered with your license — **never commit it** |
| `CODINFY_API_BASE` | no | default `https://api.codinfy.com/api` |
| `CODINFY_SITE_BASE` | no | default `https://codinfy.com` |
| `CODINFY_API_KEY` | no | `pk_live_…` forwarded as `X-Codinfy-Api-Key`; key issuance arrives with the developer portal |

## Security model

- Requests to the License API are signed **HMAC-SHA256 over the raw body**
  with an anti-replay timestamp (±300 s) — the same wire contract as the
  official PHP and Node SDKs (cross-language test vector in `tests/`).
- Responses carry an **RS256 JWT**: verify it locally in your script (see
  the [anti-tampering guide](https://github.com/bakalagoin/codinfy/blob/main/docs/sdk/INTEGRATION_GUIDE.md)).
- `X-RateLimit-*` headers are relayed in every tool result so agents can
  self-throttle (60 req/min/IP).
- This public server never exposes internal Codinfy tooling (rule R15).

## Development

```bash
npm install
npm test          # vitest — includes the PHP cross-language HMAC vector
npm run build     # tsc → dist/
node dist/index.js  # stdio server, "ready on stdio (10 tools)"
```

## 🌍 Connect with us

| Network | Codinfy | Bakala Goin (Founder & CEO) |
|---|---|---|
| **Facebook** | [@codinfyci](https://facebook.com/codinfyci) | [@bakalagoin](https://facebook.com/bakalagoin) |
| **Instagram** | [@codinfyci](https://instagram.com/codinfyci) | [@bakalagoin](https://instagram.com/bakalagoin) |
| **LinkedIn** | [company/codinfyen](https://linkedin.com/company/codinfyen/) | [bakala-goin](https://www.linkedin.com/in/bakala-goin-66428b247) |
| **TikTok** | — | [@bakalagoin](https://www.tiktok.com/@bakalagoin) |
| **X (Twitter)** | — | [@bakalagoin](https://twitter.com/bakalagoin) |

## License

[MIT](LICENSE) © 2026 **RAFLOX SAS** — Codinfy, Abidjan, Côte d'Ivoire.

---

<div align="center">

**Codinfy** — by **RAFLOX SAS** · 📧 [contact@codinfy.com](mailto:contact@codinfy.com) · 🌐 [codinfy.com](https://codinfy.com)

<sub>Part of the Codinfy MCP ecosystem · <a href="https://github.com/bakalagoin/codix-build-mcp">codix-build-mcp</a></sub>

</div>

TDQS

A3.5/5.0

Scored across 17 tools

Disambiguation5/5

All 17 tools have clearly distinct purposes. Each targets a specific resource and action (e.g., license validation vs. status check, brand assets vs. settings). There is no overlap that would confuse an agent.

Naming Consistency5/5

All tools use a consistent verb_noun snake_case pattern (e.g., create_checkout, get_product, list_ad_units). Even OAuth tools follow this implicitly. No mixing of conventions.

Tool Count4/5

17 tools cover multiple subdomains (licensing, payments, ads, branding, marketplace, auth, analytics). While slightly above the typical 15-tool threshold, each tool serves a distinct need and the count is justified for the platform's breadth.

Completeness4/5

The tool surface covers key read operations and essential writes (checkout creation, event tracking) across all subdomains. Minor gaps exist (e.g., no product creation or license revocation), but for a client-facing API these are acceptable and do not hinder common workflows.

Maintenance

ActivityStale
ResponsivenessNo issues