Skip to main content
Glama
bdrhoa
by bdrhoa

Kount Developer MCP

An independent, open-source MCP server that helps developers integrate Kount Payments Fraud v2. Inspect the API contract, generate and validate synthetic requests, authenticate against Sandbox, troubleshoot errors, and check integration progress from your coding assistant.

Unofficial community project. Not affiliated with or endorsed by Kount or Equifax.

The server uses stdio and targets Sandbox:

Setting

Value

Token endpoint

https://login-uat.equifax.com/as/token

API base URL

https://api-sandbox.kount.com

Order evaluation URL for examples

https://api-sandbox.kount.com/commerce/v2/orders?riskInquiry=true

Supported contract

Commerce OpenAPI 3.0.0, API version 2.0.0, verified November 3, 2026

Why use an MCP server?

Your assistant can look up sourced requirements and validate the actual request you are developing instead of relying on remembered field names. The same validator checks generated examples. Authentication works with credentials in the local server environment; secrets and bearer tokens are never tool outputs.

Related MCP server: 42Crunch MCP Server

Setup from source

Requires Node.js 26.13.0 or newer in the Node 26 LTS line, and npm. .nvmrc selects 26.13.0. Use your normal Node version manager if necessary.

npm ci
npm run schema:fetch
npm run build
npm test

schema:fetch explicitly downloads the public Sandbox documentation, extracts its embedded specification as JSON, verifies its fingerprint, and saves it in ~/.cache/kount-developer-mcp/commerce-v2-2026-11-03.json. It needs no credentials. KOUNT_MCP_SCHEMA_PATH can select a different absolute cache path. Restart the server after downloading the specification.

The third-party specification is not committed or shipped in the npm package: no redistribution license was found in its metadata. If the website changes, the download command fails closed until a maintainer reviews and versions the new contract. See source records and conflicts.

Without that local file, documentation, error explanations, readiness and authentication still work. Schema retrieval/validation report unavailable, and example generation reports blocked. They never claim that an unvalidated payload conforms.

npm start                    # MCP stdio server; waits for a client on stdin
npm run dev                  # run source using tsx
node examples/client.mjs     # discover tools and generate an example through MCP

Credentials and authentication

Configure these variables in the environment of the MCP server process:

Variable

Purpose

KOUNT_CLIENT_ID

Your Sandbox client ID

KOUNT_API_KEY

Your Sandbox portal API key, used as the Basic credential value

KOUNT_MCP_SCHEMA_PATH

Optional absolute path to the separately downloaded specification

Never submit credentials in chat, tool arguments, sample payloads, or committed client configuration. The server does not prompt on stdin because stdin carries the MCP protocol.

For a local file-based setup, copy .env.example to .env, fill the two values locally, and restrict its permissions:

cp .env.example .env
chmod 600 .env
node --env-file=.env dist/index.js

.env is ignored by Git and is not loaded automatically. In either client config below, you can use args = ["--env-file=/absolute/path/to/.env", "/absolute/path/to/dist/index.js"] (the equivalent JSON array in Claude Code) to load this file. Use an absolute path so the launch directory does not affect credential loading. Alternatively, set the variables in the process launching your MCP client and forward them as shown below. Restart the server after changing credentials.

Invoke authenticate_sandbox with {}. It sends a POST to exactly https://login-uat.equifax.com/as/token, with grant_type=client_credentials and scope=k1_integration_api query parameters and Authorization: Basic <API key>. This matches the request structure in the official guide, using the corrected Sandbox endpoint confirmed by the user. Supply the portal API key directly; the implementation does not encode it again or combine it with the client ID. The official token examples do not send clientId separately; it remains local configuration for the integration rather than an invented token parameter.

Tokens remain in process memory. Calls reuse a cached token, refresh on the next call shortly before expiry using expires_in, and coalesce concurrent token requests. There is no background refresh or automatic retry loop. Errors omit response bodies and secrets. Redirects are rejected and requests time out after 15 seconds. The tool returns status, cache state and expiry; it never returns the token. check_integration_readiness can report the cached authentication state without making another request. Token acquisition does not establish that an order request or product entitlement will succeed.

Connect Codex

Merge examples/codex.config.toml into ~/.codex/config.toml or a trusted project's .codex/config.toml. Replace the example path with your absolute built checkout path:

[mcp_servers.kount_developer]
command = "node"
args = ["/absolute/path/to/kount-developer-mcp/dist/index.js"]
env_vars = ["KOUNT_CLIENT_ID", "KOUNT_API_KEY"]

The variables must exist in the environment launching Codex. For GUI clients, the --env-file option above is useful when shell exports are not inherited. Configuration format verified against official Codex MCP documentation.

Connect Claude Code

Merge examples/claude.mcp.json into the consuming project's .mcp.json, replacing the path:

{
  "mcpServers": {
    "kount-developer": {
      "type": "stdio",
      "command": "node",
      "args": ["/absolute/path/to/kount-developer-mcp/dist/index.js"],
      "env": {
        "KOUNT_CLIENT_ID": "${KOUNT_CLIENT_ID:-}",
        "KOUNT_API_KEY": "${KOUNT_API_KEY:-}"
      }
    }
  }
}

Use /mcp to inspect the connection. Empty variable defaults permit use of the local tools before credentials are configured. When using --env-file, remove the env block: Node gives inherited environment variables precedence over file values, including empty values. See official Claude Code MCP documentation.

These formats were checked against current documentation. Automated tests use the official SDK client; actual Codex and Claude Code sessions have not been configured or exercised by this build.

Tools and developer workflow

Tool

Inputs

Result

get_integration_guide

topic

Requirements, recommendations, dated sources and conflicts

get_api_schema

operation, optional component

Original request/response schemas and reachable components, with an explicit Sandbox endpoint

validate_order_payload

payload JSON object

valid, status, errors, warnings, suggestions, paths and validation coverage

generate_order_example

scenario, optional includeOptionalFields

Synthetic, validator-checked payload and complete Sandbox request URL

explain_api_error

httpStatus, optional responseBody, requestPayload

Confirmed status meaning, separate hypotheses and troubleshooting steps

check_integration_readiness

capabilities, optional non-sensitive configuration

Caller-reported passed/failed checks, observed credential/authentication state, manual verification and references

authenticate_sandbox

{}

Network-enabled: obtains/caches a Sandbox token from local credentials; returns status and expiry only

Topics: authentication, device_data_collection, order_evaluation, authorization_updates, webhooks, overview.

Operations: evaluate_order, update_order, get_order, batch_update_reversals. component is an exact name from the returned components map, such as OrderPostBody or k360common.v1.Payment.

Scenarios: basic_purchase, physical_goods, digital_goods. includeOptionalFields adds a curated subset rather than every field. Examples use payment.type=NONE, constant illustrative identifiers, and no PAN or real customer data. Adapt identifiers and payment data for your integration.

Readiness capability names: authentication, token_lifecycle, device_data_collection, order_evaluation, decision_handling, authorization_updates, reversal_updates, webhook_verification, webhook_replay_protection, error_handling, security. Optional configuration accepts environment: "sandbox", authorizationFlow: "pre" | "post", webhooksEnabled: boolean, and deviceCollection: "enabled" | "excluded". No credential fields are accepted.

Example prompts:

  • “Explain the Sandbox authentication setup and authenticate using my local configuration.”

  • “Show the evaluate_order request and response schemas.”

  • “Generate a synthetic physical-goods order with optional fields.”

  • “Validate this synthetic order and separate errors from recommendations.”

  • “Explain this HTTP 500 without assuming its root cause.”

  • “Check readiness for authentication, order_evaluation and authorization_updates.”

The server performs no order evaluation/update requests and does not calculate a fraud decision. The Sandbox adapter interface is reserved for future order API operations. Sandbox authentication is implemented in this release at the user's request.

Validation meaning and limits

  • valid: true, status: "valid": passes the retrieved OpenAPI assertions and the implemented, sourced prose constraints. This is not a live API acceptance guarantee or exhaustive enforcement of every prose recommendation.

  • valid: false, status: "invalid": definite schema or implemented documented prose violations were found.

  • valid: null, status: "indeterminate": conflicting source requirements affect this payload. A documented timestamp pattern contradicts RFC3339 examples; pre-authorization authResult: null conflicts with the machine enum.

  • valid: null, status: "unavailable": the verified local contract is missing.

Ajv validates the original machine schema without coercion, field stripping, defaults, or silent repairs. uint64 strings are checked as unsigned 64-bit integers; standard formats use ajv-formats. The two nonstandard Integer and integer format labels add no constraints beyond their declared integer type. Additional implemented prose checks cover fulfillment types and custom-field name/value restrictions. Extra properties are warned about where the schema does not forbid them. Address completeness is advisory. Only merchantOrderId is marked required in the current order request schema.

Timestamp schema conflicts are preserved and surfaced rather than silently corrected. Examples omit those optional fields. An independent definite error still makes the result invalid even when another field is indeterminate.

Readiness is not source-code analysis: caller declarations are labeled as such, manual checks remain visible, and ready is always null. A cached token is the only observed network authentication evidence in this release.

Security and privacy

  • Local stdio only; no HTTP listener, database, vector store, or hosted service.

  • The six local tools work without credentials and make no network requests.

  • authenticate_sandbox sends the configured API key only to the fixed Sandbox token endpoint when explicitly invoked. No production API requests are implemented.

  • --fetch-schema is a separate explicit public-documentation download command.

  • No request payload logging, token logging, token files, or secret tool outputs.

  • MCP inputs have local limits of 256 KiB serialized JSON and depth 32. These are server resource limits, not Kount API contract requirements.

  • Use synthetic input. Your MCP client/model provider can process or retain tool arguments and results according to its own policies.

  • .env files are plaintext local configuration; restrict access and keep them out of version control. Environment variables are not an OS secret vault.

Development and verification

npm run build
npm run typecheck
npm test
npm run test:contract
npm run lint
npm run format:check

Run npm run schema:fetch before the tests. Contract tests intentionally use the fingerprinted official specification instead of a permissive mock. Tests make no live authentication or order requests; authentication tests use synthetic credentials and controlled fetch responses. MCP tests cover modern 2026-07-28 and legacy handshakes, discovery, invocation, malformed input, missing schemas and secret-safe failures.

TypeScript 6.0.3 is selected because the current typescript-eslint peer range excludes TypeScript 7. A minimatch 11.0.4 override addresses the development tooling advisory reported by npm; lint is verified with that override.

npm packaging and npx

The package has a CLI bin, compiled ESM output, declarations, and a publication allowlist. It has not been published; registry name availability is unknown. Build and create a local distributable:

npm pack
npx --yes ./kount-developer-mcp-0.1.0.tgz --fetch-schema
npx --yes ./kount-developer-mcp-0.1.0.tgz

After an authorized npm publication, consumers can use npx --yes kount-developer-mcp@0.1.0 as the MCP command. Do not use that registry command until the package is actually published and ownership verified. The specification, tests, .env, and handoff files are excluded from the package.

Contributing, license and roadmap

See CONTRIBUTING.md. Original project code is licensed under Apache-2.0. Third-party documentation, trademarks, and dependencies retain their own rights and license terms. k360pf was reviewed for patterns; no source code was copied from it.

Live Sandbox token acquisition and cache reuse were verified on November 3, 2026 using credentials already present in the local environment. No order request was sent. Next steps: configure the MCP in your development client; resolve the remaining documentation conflicts with Kount; add explicitly scoped Sandbox order operations and webhook verification helpers; expand verified examples; review and version future specification changes; publish when ready.

Shared context for Codex and Claude Code

Open this same project folder in either tool. The context lives in these version-controlled project files:

File

Purpose

AGENTS.md

Shared instructions; Codex reads this at startup.

CLAUDE.md

Imports AGENTS.md for Claude Code.

HANDOFF.md

Current state, results, open questions, and next steps, newest first.

DECISIONS.md

Accepted choices and their rationale.

docs/HANDOFF_WORKFLOW.md

Shared checkpoint procedure used by both handoff skills.

  1. Start either tool in this directory. Ask it to read HANDOFF.md and DECISIONS.md, inspect the working tree, and continue the current task.

  2. Before switching, ask the outgoing agent to checkpoint using $handoff in Codex or /handoff in Claude Code. The skill entrypoints live in .agents/skills/handoff/ and .claude/skills/handoff/ respectively.

  3. Wait for the handoff to be written and the outgoing agent to finish before letting the other agent edit this checkout.

If a newly added skill does not appear, start a fresh session from this folder. The fallback in either tool is: “Read docs/HANDOFF_WORKFLOW.md and prepare a handoff.” In Claude Code, /context can show loaded memory files.

The shared rulebook asks agents to checkpoint after meaningful work and during long tasks. The explicit handoff command gives you a way to request it before switching. Abrupt termination can still lose context since the last checkpoint. Git commits preserve the code and context files together; notes alone do not copy uncommitted files between separate checkouts or machines.

Basis for this workflow

Adapted from Nolen Jonker's shared-folder workflow on XDA (November 1, 2026), scoped to Codex and Claude Code. Either agent can take the role needed by the current task; there is no hard-coded division of labor.

Tool behavior checked against official documentation:

Architecture: src/index.ts owns CLI/stdio, src/server.ts registers tools, src/tools/ contains handlers, src/services/ contains shared documentation, schema, validation and authentication logic, src/schemas/v2/ records the verified contract fingerprint, and src/resources/v2/ contains concise original guidance.

Available Tools

7 tools
authenticate_sandboxA

Network-enabled: obtain and cache a bearer token from https://login-uat.equifax.com/as/token using local KOUNT_CLIENT_ID and KOUNT_API_KEY environment configuration. Never returns a token or credential value. No arguments and no order API calls.

NameRequiredDescriptionDefault

No parameters

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations already disclose that this is open-world, non-read-only, and non-idempotent. The description adds useful behavior beyond that: it hits the UAT login endpoint, reads local KOUNT_CLIENT_ID and KOUNT_API_KEY configuration, caches the bearer token, never returns credential values, and does not call order APIs. It omits cache duration or token expiry behavior, but the core side effects and credential handling are clear.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The definition is compact and front-loads the main action and external endpoint. Most clauses earn their place by adding endpoint, credential-source, caching, return-safety, or scope information, though the final fragment is slightly terse and could be structured more cleanly.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter authentication utility with no output schema, the description covers the external endpoint, environment-based credentials, caching behavior, and the important guarantee that secrets are not returned. It lacks details about token/cache lifetime and exactly what a successful non-secret response contains, which keeps it from being fully complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so the schema baseline is 4. The description reinforces this with 'No arguments,' which helps an agent avoid inventing inputs for an authentication call.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: obtain and cache a bearer token from the Equifax UAT token endpoint. It clearly distinguishes this authentication utility from sibling tools focused on readiness checks, schemas, validation, examples, and error explanations.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied: call this to obtain and cache auth credentials, and it explicitly says no order API calls are made. However, it does not state when in the workflow to call it, whether it must precede specific sibling tools, or what alternatives exist if authentication is already cached.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

check_integration_readinessB
Read-onlyIdempotent

Assess caller-reported capabilities and local credential/authentication status against a cited checklist. Never returns credentials or authenticates automatically. Includes manual verification; does not inspect application code or certify readiness.

NameRequiredDescriptionDefault
capabilitiesYes
configurationNo

TDQS

B3.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Even though the annotations already establish that this is a read-only, idempotent, and non-destructive closed-world operation, the description adds real behavioral context: it never returns credentials, it includes manual verification, and it does not inspect application code or certify readiness. That is materially more than the annotations convey. It does not describe what the assessment result contains, which is a remaining gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three tight sentences, with the core purpose front-loaded and every clause carrying a distinct constraint. The wording 'a cited checklist' is the only phrase that does not pay off, since nothing later explains it.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with a nested configuration object, an unenumerated checklist, and no output schema, the description covers the safety profile but not the shape or meaning of the result. The agent knows it will get an assessment but not what evidence or verdicts come back, and the meaning of 'readiness' relative to configuration is left unstated.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must carry parameter meaning, yet it only gestures at 'caller-reported capabilities' and 'local credential/authentication status.' The nested configuration object, with fields such as environment (pinned to sandbox), webhooksEnabled, deviceCollection, and authorizationFlow, is not explained at all, and neither is the 'cited checklist' the input is supposedly matched to. Readers can only infer the semantics of the 11-value capabilities enum from the value names themselves.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description gives a specific verb-resource pair: 'Assess caller-reported capabilities and local credential/authentication status against a cited checklist.' It also implicitly separates itself from authenticate_sandbox by stating it does not authenticate. The phrase 'a cited checklist' is never made concrete, so the resource is slightly under-specified.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives an inverted form of guidance, telling the agent what this tool does not do, e.g. it does not authenticate automatically, inspect application code, or certify readiness. These exclusions steer the agent away from authenticate_sandbox and get_integration_guide, but no alternative sibling is named and no positive statement says when to use this tool rather than those tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

explain_api_errorB
Read-onlyIdempotent

Explain documented status semantics, separate hypotheses, and optionally validate a synthetic payload. Never echoes response messages or infers a cause for HTTP 500.

NameRequiredDescriptionDefault
httpStatusYes
responseBodyNo
requestPayloadNo

TDQS

B3.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already establish the safety profile (readOnlyHint, idempotentHint, destructiveHint=false, openWorldHint=false), so the bar is lower, and the description still adds non-obvious behavior: it will not echo response messages (a data-handling guarantee) and will not infer a cause for HTTP 500 (an epistemic-honesty limit). The 'optionally validate a synthetic payload' clause also implies requestPayload is checked rather than sent anywhere, which is meaningful for a closed-world read tool. It stops short of describing the shape of the returned explanation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single dense sentence with no filler, and the core capability is front-loaded before the two constraints. It is compact to the point of being cryptic in the middle clause ('separate hypotheses'), but nothing is redundant.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With three undocumented parameters, nested object types, no output schema, and no annotation hints beyond safety flags, an agent still cannot predict what it will get back or how to supply responseBody and requestPayload. The description covers the tool's stance toward errors but not enough of its interface for confident invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% across three parameters, including a nested, recursively-typed responseBody and a free-form requestPayload, so the description must carry the load and largely does not. 'Synthetic payload' hints that requestPayload is a test fixture and 'never echoes response messages' hints responseBody is read but not quoted, yet the description never explains what the httpStatus range means, what responseBody accepts, or how the two interact.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a real verb-and-resource pair ('Explain documented status semantics') and adds two concrete sub-behaviors: separating hypotheses and optionally validating a synthetic payload. It is clear what the tool produces, but it never frames itself against the six sibling tools (get_api_schema, check_integration_readiness, etc.), so an agent must infer the boundary itself.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no explicit when-to-use statement, no precondition, and no named alternative. The closest thing is the negative constraint about HTTP 500, which restricts output rather than telling the agent when to call this instead of get_api_schema or check_integration_readiness.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

generate_order_exampleB
Read-onlyIdempotent

Generate a synthetic basic_purchase, physical_goods or digital_goods request; only returns payloads that pass the shared validator.

NameRequiredDescriptionDefault
scenarioYes
includeOptionalFieldsNo

TDQS

B3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, non-destructive and closed-world, so the safety profile is covered. The description adds one genuinely useful behavioral guarantee beyond that — returned payloads are guaranteed to pass the shared validator — but says nothing about output shape, repetition, or how includeOptionalFields affects the result.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single compact sentence with the key capability front-loaded and no filler. Listing the enum values duplicates schema data, which is minor waste but the overall size is well judged.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a small two-parameter generator with no output schema, the definition covers intent and output validity but leaves the boolean parameter and the returned payload's content undefined. An agent can call it, but only by guessing what includeOptionalFields does.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description carries the full burden, and it leaves includeOptionalFields completely unexplained. It restates the scenario values that the schema's enum already lists, adding no meaning about how the scenarios differ.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Names a specific verb and resource ('Generate a synthetic ... request') and enumerates the exact scenario values the tool produces, so an agent knows precisely what it emits. It also implicitly separates itself from the sibling validate_order_payload by framing output as already-validated, though it never names that sibling.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no explicit when-to-use guidance: no statement that this should be called to seed test data before validate_order_payload, and no prerequisites or exclusions. The word 'synthetic' only weakly implies a testing context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_api_schemaB
Read-onlyIdempotent

Read a separately downloaded, verified v2 request/response schema. operation: evaluate_order, update_order, get_order, batch_update_reversals; component is an exact schema name.

NameRequiredDescriptionDefault
componentNo
operationYes

TDQS

B3.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, destructiveHint=false, and openWorldHint=false, so the safety profile is covered. The description adds that the schema source is 'separately downloaded' and 'verified' (i.e., local and pre-vetted rather than live-fetched), which is genuinely useful context. It says nothing about behavior for an unknown component name or about how stale the local copy might be.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two compact, front-loaded sentences with no filler; the core purpose comes first and the parameter hints follow. The only cost is the dense, slightly opaque qualifier 'separately downloaded, verified'.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a two-parameter read tool with no output schema, the safety and locality context is adequate, and the schema enum documents the allowed operations. Missing are the shape of the returned schema and how to obtain a valid 'component' value, which an agent needs to call this successfully on the first try.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description has to carry parameter meaning, and it partially does: it clarifies that 'component' must be an exact schema name, which the bare string schema does not convey. It restates the operation enum values without explaining what each operation implies, and it never says how an agent discovers valid component names or that component is optional.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description gives a specific verb+resource: it reads a v2 request/response schema (not data, not a guide). That is distinguishable from payload-validating or example-generating siblings. It stops short of naming those siblings or stating exactly what artifact is returned, plus the phrasing 'separately downloaded, verified' is slightly cryptic.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no when-to-use or when-not-to-use guidance and no named alternatives among get_integration_guide, validate_order_payload, or explain_api_error, which are the obvious adjacent choices. The agent must infer that this is the schema-lookup step before building a payload.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_integration_guideA
Read-onlyIdempotent

Get sourced Payments Fraud v2 guidance, recommendations and unresolved documentation conflicts.

NameRequiredDescriptionDefault
topicYes

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, non-destructive and closed-world, so the safety profile is fully covered without the description. The description adds one useful trait beyond them: output is "sourced" and may contain "unresolved documentation conflicts," warning that results can be inconsistent. It says nothing about topic coverage, result format, or whether conflicts are separated from resolved guidance.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with no filler; the resource and the nature of the returned content both appear before any qualifier. Nothing can be cut without losing information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter, read-only lookup with a closed enum and no output schema, the description covers the core purpose but leaves the result shape and the meaning of "unresolved documentation conflicts" unexplained. An agent knows what to ask for but not what it will receive or how to act on conflicting guidance.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description should clarify the single required parameter, but it never mentions "topic" or how to choose among the six enum values. The enum labels are largely self-explanatory (authentication, webhooks, overview), which limits the practical damage, but the description adds no framing about scope or granularity.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Specific verb ("Get") plus scoped resource ("sourced Payments Fraud v2 guidance, recommendations and unresolved documentation conflicts"), which separates it from the action-oriented siblings like validate_order_payload or generate_order_example. It does not explicitly name get_api_schema as the adjacent alternative, so the boundary is inferable rather than stated.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied: an agent can infer this is the tool for reading topical integration guidance before acting. There is no explicit when-to-use/when-not guidance, and no routing between this tool and get_api_schema or explain_api_error, which cover adjacent knowledge needs.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

validate_order_payloadB
Read-onlyIdempotent

Validate a synthetic v2 order against the local spec and sourced prose constraints. valid:null means unavailable or indeterminate. No network calls.

NameRequiredDescriptionDefault
payloadYes

TDQS

B3.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent, non-destructive and closed-world, so 'No network calls' adds little beyond openWorldHint=false. The genuinely additive disclosure is the tri-state result semantics ('valid:null means unavailable or indeterminate'), which matters because there is no output schema, but nothing is said about what a failure result contains or how strict the spec check is.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short, front-loaded sentences with no filler; the scope statement leads. The final fragment about null semantics is terse but earns its place, and 'sourced prose constraints' is slightly jargon-heavy for the value it conveys.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single free-form payload parameter with no output schema, the description covers intent and the null case but omits how errors/invalid results are reported and what the local spec actually enforces. Adequate to call the tool, not enough to predict its responses.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% and the schema is a free-form object with arbitrary additional properties, so the description must carry the burden. It only says the payload is a 'synthetic v2 order' — no field names, required keys, version marker expectations, or examples are given, leaving the agent to guess the shape.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description gives a specific verb (validate) and resource (a synthetic v2 order payload) plus the basis of validation (local spec and sourced prose constraints). It is clearly distinct from siblings like generate_order_example or check_integration_readiness, though it never names a sibling explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is only implied: 'synthetic v2 order' signals sandbox/pre-flight validation, but there is no explicit statement of when to call this versus get_api_schema or check_integration_readiness, and no stated prerequisites or when-not conditions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 7 tool updatesv0.1.0
    • First observedauthenticate_sandbox
    • First observedcheck_integration_readiness
    • First observedexplain_api_error
    • First observedgenerate_order_example
    • First observedget_api_schema
    • First observedget_integration_guide
    • First observedvalidate_order_payload

TDQS

A3.6/5.0

Scored across 7 tools

Disambiguation4/5

Most tools have clearly distinct purposes: readiness checking, sandbox authentication, documentation, schema reading, payload validation, example generation, and error explanation. There is some minor overlap around synthetic payload handling among validate_order_payload, generate_order_example, and explain_api_error, but the descriptions clarify their different roles.

Naming Consistency5/5

All seven tools follow a consistent snake_case verb_noun pattern, such as check_integration_readiness, authenticate_sandbox, get_api_schema, and validate_order_payload. No mixed casing or conflicting naming styles are present.

Tool Count5/5

Seven tools is well-scoped for a developer integration assistant covering readiness, authentication, guidance, schema access, validation, example generation, and error explanation. Each tool appears to earn its place without unnecessary breadth.

Completeness4/5

The surface covers the main developer integration workflow from readiness and authentication through schema lookup, payload validation, example generation, and error explanation. Minor gaps remain around operation/component discovery and token lifecycle management, but core workflows are addressed.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    D
    maintenance
    Provides real-time OWASP ASVS security guidance and vulnerability scanning for AI coding agents. Enables proactive security during code generation by checking security requirements, scanning code for vulnerabilities, and suggesting secure code fixes.
    3
    MIT
  • F
    license
    Not graded
    quality
    Not graded
    maintenance
    Enables AI assistants to interact with the 42Crunch API security platform to search collections, retrieve API definitions, and access security assessments for OpenAPI specifications.
    -
  • F
    license
    Not graded
    quality
    C
    maintenance
    Enables AI coding agents to safely integrate cross-border payments by providing structured payment knowledge, deterministic validation of idempotency, security, and state-machine rules, webhook testing, executable pytest generation, and diagnosis for Python/FastAPI Checkout projects.
    -
  • F
    license
    Not graded
    quality
    C
    maintenance
    Enables AI agents and LLMs to interact with the PAYONE Commerce Platform through MCP tools for managing commerce cases, checkouts, payments, orders, and payment information.
    -