keumbang/goldpopcon-openapi-mcp
This MCP server helps coding assistants integrate with the Goldpopcon (gold/silver) Open API by exploring the API spec, generating correctly signed requests, and debugging JWT/query_hash signing issues.
API exploration:
list_endpoints,get_endpoint,list_error_codes, andsigning_guideprovide endpoint details, scopes, idempotency, rate limits, error codes, and signing rules.Signed request generation:
generate_signed_requestproduces complete executable code for Python/JavaScript/Go/curl with correctquery_hash, idempotency headers, and JWT.Local signing/debugging:
sign_requestcomputes JWT/query_hash locally from your keys and returns ready-to-use curl;verify_signaturechecks an existing JWT against server rules to diagnose 401s.Optional live read-only calls: when enabled via
GOLDPOPCON_MCP_ALLOW_LIVE=true,call_apican call only whitelisted GET endpoints (prices, balances, price history, order preview, trade history) against production; no fund-moving operations.Security-focused: secret keys are only used locally for signing/verification and are never sent over the network; live calling is disabled by default and gated by environment variables.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@keumbang/goldpopcon-openapi-mcpgenerate Python code to fetch current gold prices"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
@keumbang/goldpopcon-openapi-mcp
골드팝콘(금방) Open API 코딩 어시스턴트 MCP 서버. Claude Code · Claude Desktop · Codex CLI · Gemini CLI · Cursor 등 MCP 클라이언트에 붙여, 금·은 거래 API 연동 코드를 정확히 짜도록 돕는다.
📘 골드팝콘 Open API 문서 → https://keumbang.github.io/goldpopcon-openapi-mcp/
엔드포인트 표 · 빠른 시작 · JWT 서명 규격 · 권한/한도 · 멱등성 · 에러 코드. 스펙에서 생성되는 공식 문서다. 요청·응답 스키마는 Redoc 에서 본다. MCP 없이 직접 연동할 사람도 여기부터 읽으면 된다. (repo 안에서 바로 보려면 docs/index.md)
API 키 발급
Open API 키(gpk_ 액세스 키 + sk_ 시크릿 키)는 골드팝콘 앱에서만 발급된다. 웹 발급 경로는 없다.
골드팝콘 앱 설치 — App Store · Google Play
회원가입 후 앱 내 Open API 메뉴에서 키 발급
sk_시크릿 키는 발급 화면에서만 노출된다 — 그 자리에서 안전한 곳에 보관
이 API에서 개발자가 막히는 지점은 필드명이 아니라 요청 서명이다 — query_hash 입력이 메서드에 따라 갈리고(POST=raw body, GET=정규화 querystring) 업비트 예제를 그대로 옮기면 전부 401이 난다. 이 MCP는 그 절차를 코드로 생성하고 로컬에서 서명/검증까지 해준다.
Related MCP server: korea-stock-mcp
도구
도구 | 용도 |
| 엔드포인트 목록 — 권한 스코프·멱등성·rate 버킷 포함 |
| 단일 엔드포인트 상세 — 파라미터·본문 스키마·요청/성공 응답 예제·응답 코드 |
| 에러 코드 표 + 상태 코드별 재시도 판단 + 함정(잔액 부족=400 P0001, 인증 실패=401 error:null) |
| JWT 서명 절차 — |
| 언어별(python/javascript/go/curl) 완결형 서명 요청 코드 생성 |
| 실제 키로 JWT를 로컬 계산(디버깅) — JWT·query_hash·바로 쓸 curl 반환 |
| 이미 만든 JWT를 서버와 같은 순서로 검증 — 401 원인 진단 |
| 실제 호출 — 조회 전용·production 고정. env 로 켤 때만 등록 |
리소스: goldpopcon://openapi.yaml(전체 스펙), goldpopcon://overview(서명·한도·에러 산문).
보안:
sign_request/verify_signature/call_api에 넘긴secret_key는 로컬 서명에만 쓰이고 서명 결과(JWT)만 전송된다 — secret 자체는 네트워크를 타지 않는다.
call_api — 조회 전용 라이브 호출
기본 비활성. GOLDPOPCON_MCP_ALLOW_LIVE=true 일 때만 등록된다. 4중 안전장치로 자금 이동을 원천 차단:
env 게이트 — 변수 없으면 도구 자체가 없다
화이트리스트 —
getPrices/getBalances/getPriceHistory/getOrderPreview/getTradeHistory만.buy·sell·payout·virtual-accounts는 라이브 불가(코드 생성만)production 고정 — 인자로 서버를 바꿀 수 없다. 조회 전용이라 production 을 읽어도 자금은 움직이지 않는다
GET 강제 — 쓰기 메서드 차단
자금 이동 엔드포인트를 실제로 호출하려면 generate_signed_request 로 코드를 받아 개발자 본인 환경에서 실행한다.
읽기 자동화 — 키는 env 로
LLM 이 시세·잔고를 반복 조회하는 자동화라면 accessKey/secretKey 인자를 생략하고 env 로 준다. 인자로 넘긴 sk_ 는 호출마다 모델 컨텍스트·트랜스크립트·클라이언트 로그에 평문으로 남는다.
{
"mcpServers": {
"goldpopcon-openapi": {
"command": "npx",
"args": ["-y", "@keumbang/goldpopcon-openapi-mcp"],
"env": {
"GOLDPOPCON_MCP_ALLOW_LIVE": "true",
"GOLDPOPCON_ACCESS_KEY": "gpk_...",
"GOLDPOPCON_SECRET_KEY": "sk_..."
}
}
}
}env fallback 은 call_api(조회 전용)에만 있다. sign_request 는 buyAsset 서명까지 만들 수 있어 열지 않았다 — 열면 에이전트가 사람 개입 없이 유효한 자금 이동 서명을 찍어낸다.
call_api 는 structuredContent 로도 응답한다 — 마크다운 파싱 없이 값을 바로 쓴다.
{
"operationId": "getPrices",
"url": "https://api.goldpopcon.com/api/open/v1/prices",
"status": 200,
"ok": true,
"data": { "...": "응답 본문 JSON 그대로" },
"rateLimit": { "limit": 600, "remaining": 599, "reset": 1730000000, "retryAfter": null }
}data형태는 엔드포인트마다 다르다 —get_endpoint의 성공 응답 예제가 스펙이다.4xx/5xx 도 도구 에러가 아니라
status/ok로 온다. 루프가 분기해서 처리한다.JSON 이 아닌 본문(게이트웨이 HTML 오류 등)은
data대신raw로 온다.429 면
rateLimit.retryAfter에 대기 초. quote 600/분, trade 60/분.
설치 · 빌드
git clone https://github.com/keumbang/goldpopcon-openapi-mcp.git
cd goldpopcon-openapi-mcp
npm install
npm run build # dist/ 생성
npm test # 서명 회귀 테스트MCP 클라이언트 등록
CLI 한 줄로 붙는 클라이언트:
# Claude Code
claude mcp add goldpopcon-openapi -- npx -y @keumbang/goldpopcon-openapi-mcp
# Codex CLI (~/.codex/config.toml 에 기록된다. 세션에서 /mcp 로 연결 확인)
codex mcp add goldpopcon-openapi -- npx -y @keumbang/goldpopcon-openapi-mcp설정 파일 직접 편집(Claude Desktop claude_desktop_config.json, Cursor ~/.cursor/mcp.json, Gemini CLI ~/.gemini/settings.json):
{ "mcpServers": { "goldpopcon-openapi": { "command": "npx", "args": ["-y", "@keumbang/goldpopcon-openapi-mcp"] } } }Gemini CLI 는 PATH 해석이 불안정하다 — 서버가 안 뜨면 command 를 which npx 로 얻은 절대경로로 바꾼다.
로컬 클론 실행:
{
"mcpServers": {
"goldpopcon-openapi": {
"command": "node",
"args": ["/절대경로/goldpopcon-openapi-mcp/dist/index.js"]
}
}
}개발 중엔 command: "npx", args: ["tsx", "/절대경로/.../src/index.ts"].
환경변수
변수 | 기본 | 의미 |
| 번들 | 스펙 파일 경로 재지정 |
| (없음) |
|
| (없음) |
|
| (없음) |
|
예시 대화
"sellAsset 을 파이썬으로 호출하는 코드 줘, 금 0.5g" →
generate_signed_request(operationId=sellAsset, language=python, pathParams={asset:gold}, body={quantity:0.5})"보유한 금 전부 팔려면?" →
generate_signed_request(operationId=sellAsset, language=python, pathParams={asset:gold}, body={quantity:0.001, sell_all:true})—sell_all이 요청 수량을 무시하고 가용 잔량 전량을 체결한다"이 JWT 가 왜 401 나?" →
verify_signature(token=..., secretKey=..., method=POST, rawBody=...)"가격 이력 엔드포인트 파라미터 뭐야?" →
get_endpoint(operationId=getPriceHistory)"잔액 부족이면 몇 번 에러야?" →
list_error_codes—400 P0001(500 아님). 상태 코드별 재시도 판단표도 같이 나온다
스펙 동기화
스펙 원본은 백엔드 repo 의 docs/openapi.yaml(이 repo 밖)이고, 이 repo 는 spec/openapi.yaml 사본을 번들한다. 원본이 바뀌면 SPEC_SRC 로 경로를 지정해 갱신한다:
SPEC_SRC=/path/to/<backend-repo>/docs/openapi.yaml npm run sync-specSPEC_SRC 는 필수다. 생략하면 원본을 못 찾고 실패한다 — 백엔드 repo 명을 이 repo 에 남기지 않기 위해 기본 경로를 두지 않았다.
dist/ 가 있으면 sync-spec 이 문서 사이트(docs/index.md · docs/openapi.yaml)도 같이 다시 만든다. 스펙만 따로 갱신했다면 npm run docs 로 맞춘다 — 둘 다 생성물이라 직접 고치지 않는다. 문서 내용을 바꾸려면 백엔드 스펙의 info.description 을 고친다. 손으로 쓰는 파일은 docs/_config.yml 과 docs/redoc.html 둘뿐이다.
갱신 후 spec/openapi.yaml 과 docs/ 를 커밋한다. main 에 푸시되면 GitHub Pages 가 사이트를 다시 배포한다. 서명 규칙이 서버와 어긋나면 npm test(서버 검증 규칙 미러)가 잡는다.
<backend-repo>/docs/openapi.yaml ──sync-spec──▶ spec/openapi.yaml ──gen-docs──▶ docs/ ──Pages──▶ keumbang.github.ioAvailable Tools
7 toolsgenerate_signed_requestB
특정 엔드포인트를 호출하는 완결형 서명 코드를 생성한다(python/javascript/go/curl). query_hash 분기·멱등성 헤더를 메서드에 맞게 자동 반영.
| Name | Required | Description | Default |
|---|---|---|---|
| body | No | POST 요청 본문 객체. 생략 시 스펙 예제 사용 | |
| query | No | GET 쿼리 파라미터 | |
| server | No | production | 임의 base url. 기본 production(스펙의 유일한 서버). 실거래 없이 시험하려면 server 가 아니라 operationId 를 demoBuyAsset/demoSellAsset 으로 바꾼다 | |
| language | Yes | 생성 언어 | |
| pathParams | No | 경로 파라미터. 예: {"asset":"gold"} (buy/sell) | |
| ttlSeconds | No | JWT 수명(초). 기본 30, 최대 60 | |
| operationId | Yes | operationId. 예: sellAsset, getPriceHistory |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses two behavioral traits: automatic handling of query_hash branching and idempotency headers. However, it does not mention that the generated code is a safe, read-only operation or what side effects (e.g., actual API calls) might occur. The disclosure is partial but not misleading.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the core purpose, and immediately followed by a key behavioral detail. Every sentence is meaningful and there is no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 7 parameters and no output schema, the description is too sparse. It does not explain what the tool returns (the generated code snippet), nor does it mention prerequisites (e.g., possession of API keys). The agent lacks critical context for invoking the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with detailed parameter descriptions. The description adds no extra parameter-level meaning beyond the schema; for example, it does not clarify how 'query_hash' or 'idempotency headers' relate to specific parameters. Baseline 3 is appropriate given the schema already does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb 'generates' and specifies the resource as 'complete signed code for calling specific endpoints', listing four languages. It clearly distinguishes from sibling tools like 'sign_request' (which signs an existing request) and 'verify_signature' (which verifies).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives such as 'sign_request' or 'signing_guide'. The description lacks explicit context for when-not-to-use or prerequisites, leaving the agent without decision criteria.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_endpointA
단일 엔드포인트 상세 — 설명, 파라미터, 요청 본문 스키마와 예제, 응답 상태, 권한·멱등성.
| Name | Required | Description | Default |
|---|---|---|---|
| operationId | Yes | operationId. 예: buyAsset, getPrices, getPriceHistory |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It discloses that the tool returns details on authorization and idempotency (권한·멱등성), but does not clarify if the operation is read-only, how it handles missing operationId (though required), or any rate limits. The exposure of idempotency info hints at safety but lacks comprehensive behavioral details.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence listing clearly what details are returned. It is front-loaded with the core purpose. Could be considered slightly dense due to the list of attributes, but overall efficient. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has only one required parameter with full schema coverage, no output schema, and the description lists all major return categories, it provides sufficient context for an agent to invoke it correctly. The lone missing piece is a mention of the return format (e.g., JSON), but the example-driven description compensates well.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so baseline is 3. The description adds the example value 'buyAsset, getPrices, getPriceHistory' for the operationId parameter, which is helpful but does not go beyond what the schema already provides (a string with description). No additional semantics beyond the parameter name and example.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description explicitly states '단일 엔드포인트 상세' (single endpoint details) and lists the specific attributes returned: 설명, 파라미터, 요청 본문 스키마와 예제, 응답 상태, 권한·멱등성. This clearly distinguishes it from sibling tool 'list_endpoints' which likely returns a list of endpoints rather than details for one.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies use when needing details of a specific endpoint by operationId. However, it does not explicitly contrast with alternatives like 'list_endpoints' (which lists all endpoints) or mention when not to use this tool (e.g., if you only need error codes, use 'list_error_codes' instead). The usage context is clear but lacks explicit exclusions or alternative guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_endpointsA
금방 Open API 엔드포인트 목록. 각 항목의 권한 스코프·멱등성 필요 여부·rate limit 버킷을 함께 준다.
| Name | Required | Description | Default |
|---|---|---|---|
| openApiOnly | No | true 면 /open/* 만. 기본 true — 현재 스펙은 전부 /open/* 이라 결과가 같다 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. It describes the output inclusions (scope, idempotency, rate limit) which is good, but does not disclose any behavioral traits such as caching, pagination, authentication requirements, or whether it is a safe read operation. Adequate but could be more transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, no wasted words. Front-loaded with the key verb 'list' and resource. Every sentence adds unique value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given only one simple boolean parameter and no output schema, the description is complete enough for a listing endpoint. It names the key output fields (scope, idempotency, rate limit bucket) which helps the agent understand what to expect. No missing critical information.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description adds minimal extra meaning beyond the schema's description of the boolean parameter, only restating that default is true and that all endpoints are currently /open/*. No additional clarity on parameter semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states it lists Open API endpoints and provides scope, idempotency, and rate limit info. It clearly specifies the resource ('Open API 엔드포인트 목록') and what each item includes, but does not explicitly distinguish from siblings like 'get_endpoint' or 'list_error_codes'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit when-to-use or when-not-to-use guidance is given, nor alternatives mentioned. The context of 'currently all /open/*' is helpful but does not guide the agent on when to prefer this over get_endpoint or other list tools. Implied usage for exploring endpoints, but lacks exclusions or prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_error_codesA
금방 Open API 에러 코드 표와 함정(잔액 부족은 400 P0001, 인증 실패는 error=null 401, 503 fail-closed 등). 상태 코드별 재시도 판단표 포함.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description fully bears the burden of behavioral disclosure. It explicitly discloses specific error code pitfalls (e.g., insufficient balance, authentication failure) and states the inclusion of a retry judgment table, which informs the agent of the tool's scope and limitations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very concise and front-loaded, but it uses a non-standard format (parenthetical examples, semicolons). The key information is present, but the structure could be clearer for an agent.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given zero parameters, no output schema, and no annotations, the description is complete. It explains the tool's purpose, lists concrete examples of what it reveals (specific error codes, pitfalls), and mentions the retry table. There are no gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters and schema description coverage is 100% (empty schema). The description adds no parameter information because none is needed. This is a baseline 4, upgraded to 5 because the description's content about error codes and retry table is exactly what the agent needs to know for this parameterless tool.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states what the tool does: it lists Open API error codes and common pitfalls (e.g., insufficient balance returns 400 P0001, authentication failure returns error=null 401, 503 fail-closed). This distinguishes it from siblings like list_endpoints or signing_guide.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description mentions it includes a retry judgment table by status code, implying it should be used for understanding error handling and retry logic. However, no explicit guidance is given on when to use this tool versus siblings like get_endpoint or signing_guide.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
signing_guideA
요청 서명(JWT + query_hash) 절차. 개발자가 가장 많이 막히는 지점 — 업비트 예제를 그대로 옮기면 전부 401 이 나는 이유 포함.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description must fully communicate behavioral traits. It describes the tool as a 'procedure' or guide, implying it is non-destructive and informational. It also adds context about debugging common signing errors. However, it does not explicitly state that the tool does not make API calls or have side effects, leaving minor ambiguity.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two concise sentences in Korean. The first sentence states the core purpose, and the second provides a critical usage hint (common failure point). No extraneous text; every sentence earns its place. It is front-loaded and efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no parameters and no output schema, the description adequately covers the tool's nature as a reference guide. It names the signing method (JWT + query_hash) and a specific error scenario. However, it does not describe the output format (e.g., return type or content structure), which could aid an agent in processing the result.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are zero parameters with 100% schema coverage, so the baseline is 4. The description does not need to explain parameters. It adds no parameter-specific information, but none is required. The description's focus on the signing guide content is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose as a procedure for request signing (JWT + query_hash). It also adds specific value by mentioning a common pitfall (401 errors when copying the Upbit example), which distinguishes it from sibling tools like sign_request that actually perform signing.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implicitly guides usage by highlighting the tool as a reference for developers stuck on 401 errors from copying examples. However, it does not explicitly state when not to use it (e.g., when actual signing is needed) or mention alternatives like generate_signed_request. The context provides some inference, but lacks direct exclusion.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sign_requestB
실제 키로 요청 하나의 JWT 를 로컬 계산한다(디버깅용). secret_key 는 로컬에서만 쓰이고 어디로도 전송되지 않는다. 결과에 JWT·query_hash·바로 쓸 curl 을 준다.
| Name | Required | Description | Default |
|---|---|---|---|
| body | No | POST 본문 객체. 생략 시 스펙 예제 | |
| query | No | ||
| server | No | production | 임의 base url. 기본 production(스펙의 유일한 서버). 실거래 없이 시험하려면 operationId 를 demoBuyAsset/demoSellAsset 으로 바꾼다 | |
| accessKey | Yes | gpk_... 액세스 키 | |
| secretKey | Yes | sk_... 시크릿 키. 로컬 계산에만 사용 | |
| pathParams | No | 경로 파라미터. 예: {"asset":"gold"} | |
| ttlSeconds | No | ||
| operationId | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full burden. It discloses that secret_key is not transmitted (local only), which is a key safety trait. However, it does not mention whether the tool makes any network calls, what happens on invalid keys or missing inputs, or any error behavior. The positive safety statement is useful but leaves several behavioral aspects undisclosed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three sentences long and front-loads the main purpose (local JWT computation for debugging). It is compact, uses simple language, and conveys key points without redundancy. A minor improvement could be structuring the output components as a list, but overall it is efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 8 parameters, nested objects, no output schema, and no annotations, the description provides core purpose and safety but lacks a complete usage story. It does not explain how to construct inputs (e.g., which operationId to use, how to fill pathParams), nor does it detail the output format beyond naming three components. The description partially compensates but leaves gaps for a full understanding.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already provides descriptions for 5 out of 8 parameters (63% coverage), including hints for 'body', 'server', 'accessKey', 'secretKey', and 'pathParams'. The description adds overall purpose and a safety note about secret key locality but does not add detailed semantics for individual parameters beyond what the schema states. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool computes a JWT locally for a single request using real keys (debugging purpose). It specifies the result includes JWT, query_hash, and a ready-to-use curl command. However, it does not explicitly differentiate from the sibling tool 'generate_signed_request' or other alternatives, so purpose is clear but not fully positioned among siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description marks the tool for debugging ('디버깅용') and emphasizes that the secret key is used only locally, implying it is safe for testing. However, it does not explicitly state when to use this tool versus alternatives like 'generate_signed_request' or 'verify_signature', nor does it mention prerequisites or exclusions. Usage context is implied but not fully explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
verify_signatureB
이미 만든 JWT 를 서버와 같은 순서로 로컬 검증해 401 원인을 짚는다. secret_key·전송할 본문/쿼리를 주면 query_hash 불일치까지 진단한다.
| Name | Required | Description | Default |
|---|---|---|---|
| query | No | 실제 전송한(할) 쿼리. GET 계열 대조용 | |
| token | Yes | 검증할 JWT(Bearer 접두사 있어도 됨) | |
| method | Yes | ||
| rawBody | No | 실제 전송한(할) 본문 raw 문자열. POST 계열 query_hash 대조용 | |
| secretKey | Yes | sk_... 시크릿 키 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description partially fulfills the behavioral transparency burden. It discloses that verification is local ('로컬') and can diagnose query_hash mismatches. However, it does not mention idempotency, side effects (e.g., no mutation), required permissions, or response format. The description adds some value but is not fully comprehensive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, dense sentence that packs purpose, method, and diagnostic scope without redundancy. It is front-loaded with the main action ('로컬 검증') and efficiently adds key constraints ('같은 순서로'). It could improve by breaking into two sentences for readability.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 5 parameters, no output schema, and no annotations, the description provides moderate coverage. It explains the diagnostic purpose and links two parameters to specific use cases, but omits mention of the 'method' parameter's role in verification logic, the 'token' prefix handling, and any post-verification output structure. Additional context on return values or errors would improve completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 80%, so the baseline is 3. The description adds context by linking 'query' (GET verification) and 'rawBody' (POST hash comparison) to use cases, which goes beyond the raw schema descriptions. However, the description does not explain the 'method' parameter's role in hash computation or the 'token' parameter's format tolerance beyond what the schema notes.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses specific verbs ('verify', 'diagnose') and resources ('JWT', 'query_hash'), clearly stating it validates a JWT locally and identifies 401 causes, including query_hash mismatches. It distinguishes from sibling tools like 'sign_request' and 'generate_signed_request' which focus on creation, not verification.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for debugging 401 errors and checking hash consistency, but does not explicitly state when to use this tool versus alternatives like 'signing_guide' for learning about signing, or 'list_error_codes' for error interpretation. No direct exclusions or prerequisites (e.g., requiring the secret key) are mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
7 tool updates
v0.3.1- First observed
generate_signed_request - First observed
get_endpoint - First observed
list_endpoints - First observed
list_error_codes - First observed
sign_request - First observed
signing_guide - First observed
verify_signature
TDQS
Scored across 7 tools
Each tool serves a distinct purpose: listing endpoints, getting details, error codes, signing guide, generating signed code, local signature computation, and signature verification. No overlap in functionality.
Most tools follow a clear verb_noun pattern (list_endpoints, get_endpoint, generate_signed_request, sign_request, verify_signature). The one deviation is 'signing_guide' which uses a gerund-noun form, but otherwise naming is uniform and predictable.
With 7 tools, the server is well-scoped for its purpose: providing API endpoint discovery, error handling, and request signing utilities. Each tool earns its place without being too many or too few.
The tool set covers the full workflow for an OpenAPI helper: discover endpoints, understand errors, learn signing, generate signed code, debug signature issues. No obvious gaps for its intended domain.
Maintenance
Related MCP Connectors
- mcpweaveOAuthcom.mcpweave
Korea-native MCP gateway: Korean commerce, payments, messaging, gov & finance APIs for AI agents.
Cloudflare Workers MCP server: govdata-korea
Unlock the power of real-time cryptocurrency data with our Crypto Price Insights MCP server.
The OpenZeppelin Solidity Contracts MCP server integrates OpenZeppelin's security and style rules into AI-driven development workflows, enabling AI assistants to generate safe, correct, and production-ready smart contracts. It automatically validates generated code against OpenZeppelin standards (including imports, modifiers, naming conventions, and security checks) and supports various contract types including ERC-20, ERC-721, ERC-1155, Stablecoins, RWA, Governor, and Account contracts through prompt-driven workflows.
Related MCP Servers
- AlicenseNot gradedqualityDmaintenanceAn MCP server that provides current and historical gold/precious metal prices (gold, silver, platinum, and palladium) via the GoldAPI.io service with support for multiple currencies.1MIT
- ISC
- FlicenseAqualityDmaintenanceAn MCP server that enables natural language control of Kiwoom Securities accounts through Claude Desktop. It provides tools for stock price lookup, buying and selling stocks, and analyzing portfolios or trade history via the Kiwoom REST API.112-
- AlicenseCqualityBmaintenanceSafe-by-default MCP server for the official Toss Securities Open API, providing read-only market and account data with optional order operations protected by multiple safety gates.27102MIT