keumbang/goldpopcon-openapi-mcp
@keumbang/goldpopcon-openapi-mcp
골드팝콘(금방) Open API MCP-Server für Codierungsassistenten. Er hilft, präzisen Code für die Integration von Gold- und Silberhandels-APIs zu schreiben, wenn er an MCP-Clients wie Claude Code, Claude Desktop, Codex CLI, Gemini CLI, Cursor usw. angeschlossen wird.
API-Schlüssel beantragen
Open-API-Schlüssel (gpk_ Zugriffsschlüssel + sk_ geheimer Schlüssel) werden nur in der Gold Popcorn App ausgestellt. Es gibt keinen Weg zur Ausstellung über das Web.
Gold Popcorn App installieren — App Store · Google Play
Nach der Registrierung Schlüssel im Open-API-Menü der App ausstellen.
Der
sk_geheime Schlüssel wird nur auf dem Ausstellungsbildschirm angezeigt — bewahren Sie ihn sofort an einem sicheren Ort auf.
Der Punkt, an dem Entwickler bei dieser API hängen bleiben, sind nicht die Feldnamen, sondern die Anfragesignatur — die query_hash-Eingabe variiert je nach Methode (POST=roher Body, GET=normalisierte Query-String) und wenn man das Upbit-Beispiel direkt übernimmt, erhält man überall 401. Dieser MCP generiert diesen Prozess als Code und führt die Signatur/Verifizierung lokal durch.
Related MCP server: korea-stock-mcp
Werkzeuge
Werkzeug | Zweck |
| Liste der Endpunkte — inklusive Berechtigungsbereiche, Idempotenz, Rate-Buckets |
| Details eines einzelnen Endpunkts — Parameter, Body-Schema, Beispiele für Anfrage/erfolgreiche Antwort, Antwortcodes |
| Fehlercodetabelle + Wiederholungsentscheidung nach Statuscode + Fallstricke (Kontostand unzureichend=400 P0001, Authentifizierungsfehler=401 error:null) |
| JWT-Signaturverfahren — |
| Generiert vollständigen signierten Anforderungscode pro Sprache (python/javascript/go/curl) |
| Berechnet JWT lokal mit echtem Schlüssel (Debugging) — gibt JWT, query_hash, sofort verwendbares curl zurück |
| Überprüft bereits erstelltes JWT in derselben Reihenfolge wie der Server — Diagnose von 401-Ursachen |
| Tatsächlicher Aufruf — nur Abfrage, production fest. Wird nur registriert, wenn per env aktiviert. |
Ressourcen: goldpopcon://openapi.yaml (vollständige Spezifikation), goldpopcon://overview (Prosa zu Signatur, Limits, Fehlern).
Sicherheit: Der an
sign_request/verify_signature/call_apiübergebenesecret_keywird nur für die lokale Signatur verwendet und nur das Signaturergebnis (JWT) wird übertragen — das Secret selbst wird nicht über das Netzwerk gesendet.
call_api — Live-Aufruf nur für Abfragen
Standardmäßig deaktiviert. Wird nur registriert, wenn GOLDPOPCON_MCP_ALLOW_LIVE=true gesetzt ist. Vierfache Sicherheitsvorkehrungen blockieren Geldbewegungen grundsätzlich:
Env-Gate — ohne Variable existiert das Werkzeug nicht
Whitelist — nur
getPrices/getBalances/getPriceHistory/getOrderPreview/getTradeHistory.buy·sell·payout·virtual-accountssind nicht live möglich (nur Codegenerierung)Production fest — Der Server kann nicht über Argumente geändert werden. Da es sich um reine Abfragen handelt, bewegt das Lesen von Production kein Geld.
GET erzwungen — Schreibmethoden blockiert
Um Geldbewegungsendpunkte tatsächlich aufzurufen, erhalten Sie den Code über generate_signed_request und führen ihn in Ihrer eigenen Entwicklungsumgebung aus.
Leseautomatisierung — Schlüssel per env
Wenn es sich um eine Automatisierung handelt, bei der das LLM wiederholt Kurse und Kontostände abfragt, lassen Sie die Argumente accessKey/secretKey weg und geben Sie sie per env. Das als Argument übergebene sk_ bleibt bei jedem Aufruf im Klartext im Modellkontext, Transkript und Client-Log.
{
"mcpServers": {
"goldpopcon-openapi": {
"command": "npx",
"args": ["-y", "@keumbang/goldpopcon-openapi-mcp"],
"env": {
"GOLDPOPCON_MCP_ALLOW_LIVE": "true",
"GOLDPOPCON_ACCESS_KEY": "gpk_...",
"GOLDPOPCON_SECRET_KEY": "sk_..."
}
}
}
}Der env-Fallback existiert nur für call_api (nur Abfragen). sign_request wurde nicht geöffnet, da es bis zur Signatur von buyAsset reichen kann — wenn geöffnet, könnte der Agent ohne menschliches Eingreifen gültige Signaturen für Geldbewegungen erstellen.
call_api antwortet auch mit structuredContent — Werte können direkt ohne Markdown-Parsing verwendet werden.
{
"operationId": "getPrices",
"url": "https://api.goldpopcon.com/api/open/v1/prices",
"status": 200,
"ok": true,
"data": { "...": "응답 본문 JSON 그대로" },
"rateLimit": { "limit": 600, "remaining": 599, "reset": 1730000000, "retryAfter": null }
}Die Form von
datavariiert pro Endpunkt — das Beispiel einer erfolgreichen Antwort vonget_endpointist die Spezifikation.Auch 4xx/5xx kommen nicht als Werkzeugfehler, sondern als
status/ok. Die Schleife verzweigt und verarbeitet sie.Nicht-JSON-Inhalte (Gateway-HTML-Fehler usw.) kommen als
rawstattdata.Bei 429 enthält
rateLimit.retryAfterdie Wartezeit in Sekunden. Quote 600/Minute, Trade 60/Minute.
Installation · Build
git clone https://github.com/keumbang/goldpopcon-openapi-mcp.git
cd goldpopcon-openapi-mcp
npm install
npm run build # dist/ 생성
npm test # 서명 회귀 테스트MCP-Client-Registrierung
Clients, die mit einer CLI-Zeile verbunden werden:
# Claude Code
claude mcp add goldpopcon-openapi -- npx -y @keumbang/goldpopcon-openapi-mcp
# Codex CLI (~/.codex/config.toml 에 기록된다. 세션에서 /mcp 로 연결 확인)
codex mcp add goldpopcon-openapi -- npx -y @keumbang/goldpopcon-openapi-mcpDirekte Bearbeitung der Konfigurationsdatei (Claude Desktop claude_desktop_config.json, Cursor ~/.cursor/mcp.json, Gemini CLI ~/.gemini/settings.json):
{ "mcpServers": { "goldpopcon-openapi": { "command": "npx", "args": ["-y", "@keumbang/goldpopcon-openapi-mcp"] } } }Gemini CLI interpretiert PATH instabil — wenn der Server nicht startet, ersetzen Sie command durch den absoluten Pfad, den Sie mit which npx erhalten.
Lokalen Klon ausführen:
{
"mcpServers": {
"goldpopcon-openapi": {
"command": "node",
"args": ["/절대경로/goldpopcon-openapi-mcp/dist/index.js"]
}
}
}Während der Entwicklung: command: "npx", args: ["tsx", "/absoluterPfad/.../src/index.ts"].
Umgebungsvariablen
Variable | Standard | Bedeutung |
| Gebündelt | Pfad zur Spezifikationsdatei überschreiben |
| (kein) | Wenn |
| (kein) | Standardwert für |
| (kein) | Standardwert für |
Beispiel-Dialoge
"Gib mir Code, um sellAsset in Python aufzurufen, Gold 0,5g" →
generate_signed_request(operationId=sellAsset, language=python, pathParams={asset:gold}, body={quantity:0.5})"Um das gesamte gehaltene Gold zu verkaufen?" →
generate_signed_request(operationId=sellAsset, language=python, pathParams={asset:gold}, body={quantity:0.001, sell_all:true})—sell_allignoriert die angeforderte Menge und führt die gesamte verfügbare Restmenge aus."Warum gibt dieses JWT 401?" →
verify_signature(token=..., secretKey=..., method=POST, rawBody=...)"Was sind die Parameter des Preisverlaufs-Endpunkts?" →
get_endpoint(operationId=getPriceHistory)"Welcher Fehler bei unzureichendem Kontostand?" →
list_error_codes—400 P0001(nicht 500). Die Tabelle zur Wiederholungsentscheidung nach Statuscode wird ebenfalls angezeigt.
Spezifikationssynchronisation
Die ursprüngliche Spezifikation befindet sich im Backend-Repo unter docs/openapi.yaml (außerhalb dieses Repos), und dieses Repo bündelt eine Kopie in spec/openapi.yaml. Wenn sich das Original ändert, aktualisieren Sie es, indem Sie den Pfad mit SPEC_SRC angeben:
SPEC_SRC=/path/to/<backend-repo>/docs/openapi.yaml npm run sync-specSPEC_SRC ist erforderlich. Wenn es weggelassen wird, wird das Original nicht gefunden und schlägt fehl — es wurde kein Standardpfad festgelegt, um den Backend-Repo-Namen nicht in diesem Repo zu hinterlassen.
Nach der Aktualisierung committen Sie spec/openapi.yaml. Wenn die Signaturregeln vom Server abweichen, wird dies von npm test (Spiegel der Server-Validierungsregeln) erkannt.
<backend-repo>/docs/openapi.yaml ──sync-spec──▶ spec/openapi.yamlAvailable Tools
7 toolsgenerate_signed_requestB
특정 엔드포인트를 호출하는 완결형 서명 코드를 생성한다(python/javascript/go/curl). query_hash 분기·멱등성 헤더를 메서드에 맞게 자동 반영.
| Name | Required | Description | Default |
|---|---|---|---|
| body | No | POST 요청 본문 객체. 생략 시 스펙 예제 사용 | |
| query | No | GET 쿼리 파라미터 | |
| server | No | production | 임의 base url. 기본 production(스펙의 유일한 서버). 실거래 없이 시험하려면 server 가 아니라 operationId 를 demoBuyAsset/demoSellAsset 으로 바꾼다 | |
| language | Yes | 생성 언어 | |
| pathParams | No | 경로 파라미터. 예: {"asset":"gold"} (buy/sell) | |
| ttlSeconds | No | JWT 수명(초). 기본 30, 최대 60 | |
| operationId | Yes | operationId. 예: sellAsset, getPriceHistory |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses two behavioral traits: automatic handling of query_hash branching and idempotency headers. However, it does not mention that the generated code is a safe, read-only operation or what side effects (e.g., actual API calls) might occur. The disclosure is partial but not misleading.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the core purpose, and immediately followed by a key behavioral detail. Every sentence is meaningful and there is no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 7 parameters and no output schema, the description is too sparse. It does not explain what the tool returns (the generated code snippet), nor does it mention prerequisites (e.g., possession of API keys). The agent lacks critical context for invoking the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with detailed parameter descriptions. The description adds no extra parameter-level meaning beyond the schema; for example, it does not clarify how 'query_hash' or 'idempotency headers' relate to specific parameters. Baseline 3 is appropriate given the schema already does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb 'generates' and specifies the resource as 'complete signed code for calling specific endpoints', listing four languages. It clearly distinguishes from sibling tools like 'sign_request' (which signs an existing request) and 'verify_signature' (which verifies).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives such as 'sign_request' or 'signing_guide'. The description lacks explicit context for when-not-to-use or prerequisites, leaving the agent without decision criteria.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_endpointA
단일 엔드포인트 상세 — 설명, 파라미터, 요청 본문 스키마와 예제, 응답 상태, 권한·멱등성.
| Name | Required | Description | Default |
|---|---|---|---|
| operationId | Yes | operationId. 예: buyAsset, getPrices, getPriceHistory |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It discloses that the tool returns details on authorization and idempotency (권한·멱등성), but does not clarify if the operation is read-only, how it handles missing operationId (though required), or any rate limits. The exposure of idempotency info hints at safety but lacks comprehensive behavioral details.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence listing clearly what details are returned. It is front-loaded with the core purpose. Could be considered slightly dense due to the list of attributes, but overall efficient. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has only one required parameter with full schema coverage, no output schema, and the description lists all major return categories, it provides sufficient context for an agent to invoke it correctly. The lone missing piece is a mention of the return format (e.g., JSON), but the example-driven description compensates well.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so baseline is 3. The description adds the example value 'buyAsset, getPrices, getPriceHistory' for the operationId parameter, which is helpful but does not go beyond what the schema already provides (a string with description). No additional semantics beyond the parameter name and example.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description explicitly states '단일 엔드포인트 상세' (single endpoint details) and lists the specific attributes returned: 설명, 파라미터, 요청 본문 스키마와 예제, 응답 상태, 권한·멱등성. This clearly distinguishes it from sibling tool 'list_endpoints' which likely returns a list of endpoints rather than details for one.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies use when needing details of a specific endpoint by operationId. However, it does not explicitly contrast with alternatives like 'list_endpoints' (which lists all endpoints) or mention when not to use this tool (e.g., if you only need error codes, use 'list_error_codes' instead). The usage context is clear but lacks explicit exclusions or alternative guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_endpointsA
금방 Open API 엔드포인트 목록. 각 항목의 권한 스코프·멱등성 필요 여부·rate limit 버킷을 함께 준다.
| Name | Required | Description | Default |
|---|---|---|---|
| openApiOnly | No | true 면 /open/* 만. 기본 true — 현재 스펙은 전부 /open/* 이라 결과가 같다 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. It describes the output inclusions (scope, idempotency, rate limit) which is good, but does not disclose any behavioral traits such as caching, pagination, authentication requirements, or whether it is a safe read operation. Adequate but could be more transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, no wasted words. Front-loaded with the key verb 'list' and resource. Every sentence adds unique value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given only one simple boolean parameter and no output schema, the description is complete enough for a listing endpoint. It names the key output fields (scope, idempotency, rate limit bucket) which helps the agent understand what to expect. No missing critical information.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description adds minimal extra meaning beyond the schema's description of the boolean parameter, only restating that default is true and that all endpoints are currently /open/*. No additional clarity on parameter semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states it lists Open API endpoints and provides scope, idempotency, and rate limit info. It clearly specifies the resource ('Open API 엔드포인트 목록') and what each item includes, but does not explicitly distinguish from siblings like 'get_endpoint' or 'list_error_codes'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit when-to-use or when-not-to-use guidance is given, nor alternatives mentioned. The context of 'currently all /open/*' is helpful but does not guide the agent on when to prefer this over get_endpoint or other list tools. Implied usage for exploring endpoints, but lacks exclusions or prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_error_codesA
금방 Open API 에러 코드 표와 함정(잔액 부족은 400 P0001, 인증 실패는 error=null 401, 503 fail-closed 등). 상태 코드별 재시도 판단표 포함.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description fully bears the burden of behavioral disclosure. It explicitly discloses specific error code pitfalls (e.g., insufficient balance, authentication failure) and states the inclusion of a retry judgment table, which informs the agent of the tool's scope and limitations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very concise and front-loaded, but it uses a non-standard format (parenthetical examples, semicolons). The key information is present, but the structure could be clearer for an agent.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given zero parameters, no output schema, and no annotations, the description is complete. It explains the tool's purpose, lists concrete examples of what it reveals (specific error codes, pitfalls), and mentions the retry table. There are no gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters and schema description coverage is 100% (empty schema). The description adds no parameter information because none is needed. This is a baseline 4, upgraded to 5 because the description's content about error codes and retry table is exactly what the agent needs to know for this parameterless tool.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states what the tool does: it lists Open API error codes and common pitfalls (e.g., insufficient balance returns 400 P0001, authentication failure returns error=null 401, 503 fail-closed). This distinguishes it from siblings like list_endpoints or signing_guide.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description mentions it includes a retry judgment table by status code, implying it should be used for understanding error handling and retry logic. However, no explicit guidance is given on when to use this tool versus siblings like get_endpoint or signing_guide.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
signing_guideA
요청 서명(JWT + query_hash) 절차. 개발자가 가장 많이 막히는 지점 — 업비트 예제를 그대로 옮기면 전부 401 이 나는 이유 포함.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description must fully communicate behavioral traits. It describes the tool as a 'procedure' or guide, implying it is non-destructive and informational. It also adds context about debugging common signing errors. However, it does not explicitly state that the tool does not make API calls or have side effects, leaving minor ambiguity.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two concise sentences in Korean. The first sentence states the core purpose, and the second provides a critical usage hint (common failure point). No extraneous text; every sentence earns its place. It is front-loaded and efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no parameters and no output schema, the description adequately covers the tool's nature as a reference guide. It names the signing method (JWT + query_hash) and a specific error scenario. However, it does not describe the output format (e.g., return type or content structure), which could aid an agent in processing the result.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are zero parameters with 100% schema coverage, so the baseline is 4. The description does not need to explain parameters. It adds no parameter-specific information, but none is required. The description's focus on the signing guide content is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose as a procedure for request signing (JWT + query_hash). It also adds specific value by mentioning a common pitfall (401 errors when copying the Upbit example), which distinguishes it from sibling tools like sign_request that actually perform signing.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implicitly guides usage by highlighting the tool as a reference for developers stuck on 401 errors from copying examples. However, it does not explicitly state when not to use it (e.g., when actual signing is needed) or mention alternatives like generate_signed_request. The context provides some inference, but lacks direct exclusion.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sign_requestB
실제 키로 요청 하나의 JWT 를 로컬 계산한다(디버깅용). secret_key 는 로컬에서만 쓰이고 어디로도 전송되지 않는다. 결과에 JWT·query_hash·바로 쓸 curl 을 준다.
| Name | Required | Description | Default |
|---|---|---|---|
| body | No | POST 본문 객체. 생략 시 스펙 예제 | |
| query | No | ||
| server | No | production | 임의 base url. 기본 production(스펙의 유일한 서버). 실거래 없이 시험하려면 operationId 를 demoBuyAsset/demoSellAsset 으로 바꾼다 | |
| accessKey | Yes | gpk_... 액세스 키 | |
| secretKey | Yes | sk_... 시크릿 키. 로컬 계산에만 사용 | |
| pathParams | No | 경로 파라미터. 예: {"asset":"gold"} | |
| ttlSeconds | No | ||
| operationId | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full burden. It discloses that secret_key is not transmitted (local only), which is a key safety trait. However, it does not mention whether the tool makes any network calls, what happens on invalid keys or missing inputs, or any error behavior. The positive safety statement is useful but leaves several behavioral aspects undisclosed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three sentences long and front-loads the main purpose (local JWT computation for debugging). It is compact, uses simple language, and conveys key points without redundancy. A minor improvement could be structuring the output components as a list, but overall it is efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 8 parameters, nested objects, no output schema, and no annotations, the description provides core purpose and safety but lacks a complete usage story. It does not explain how to construct inputs (e.g., which operationId to use, how to fill pathParams), nor does it detail the output format beyond naming three components. The description partially compensates but leaves gaps for a full understanding.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already provides descriptions for 5 out of 8 parameters (63% coverage), including hints for 'body', 'server', 'accessKey', 'secretKey', and 'pathParams'. The description adds overall purpose and a safety note about secret key locality but does not add detailed semantics for individual parameters beyond what the schema states. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool computes a JWT locally for a single request using real keys (debugging purpose). It specifies the result includes JWT, query_hash, and a ready-to-use curl command. However, it does not explicitly differentiate from the sibling tool 'generate_signed_request' or other alternatives, so purpose is clear but not fully positioned among siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description marks the tool for debugging ('디버깅용') and emphasizes that the secret key is used only locally, implying it is safe for testing. However, it does not explicitly state when to use this tool versus alternatives like 'generate_signed_request' or 'verify_signature', nor does it mention prerequisites or exclusions. Usage context is implied but not fully explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
verify_signatureB
이미 만든 JWT 를 서버와 같은 순서로 로컬 검증해 401 원인을 짚는다. secret_key·전송할 본문/쿼리를 주면 query_hash 불일치까지 진단한다.
| Name | Required | Description | Default |
|---|---|---|---|
| query | No | 실제 전송한(할) 쿼리. GET 계열 대조용 | |
| token | Yes | 검증할 JWT(Bearer 접두사 있어도 됨) | |
| method | Yes | ||
| rawBody | No | 실제 전송한(할) 본문 raw 문자열. POST 계열 query_hash 대조용 | |
| secretKey | Yes | sk_... 시크릿 키 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description partially fulfills the behavioral transparency burden. It discloses that verification is local ('로컬') and can diagnose query_hash mismatches. However, it does not mention idempotency, side effects (e.g., no mutation), required permissions, or response format. The description adds some value but is not fully comprehensive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, dense sentence that packs purpose, method, and diagnostic scope without redundancy. It is front-loaded with the main action ('로컬 검증') and efficiently adds key constraints ('같은 순서로'). It could improve by breaking into two sentences for readability.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 5 parameters, no output schema, and no annotations, the description provides moderate coverage. It explains the diagnostic purpose and links two parameters to specific use cases, but omits mention of the 'method' parameter's role in verification logic, the 'token' prefix handling, and any post-verification output structure. Additional context on return values or errors would improve completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 80%, so the baseline is 3. The description adds context by linking 'query' (GET verification) and 'rawBody' (POST hash comparison) to use cases, which goes beyond the raw schema descriptions. However, the description does not explain the 'method' parameter's role in hash computation or the 'token' parameter's format tolerance beyond what the schema notes.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses specific verbs ('verify', 'diagnose') and resources ('JWT', 'query_hash'), clearly stating it validates a JWT locally and identifies 401 causes, including query_hash mismatches. It distinguishes from sibling tools like 'sign_request' and 'generate_signed_request' which focus on creation, not verification.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for debugging 401 errors and checking hash consistency, but does not explicitly state when to use this tool versus alternatives like 'signing_guide' for learning about signing, or 'list_error_codes' for error interpretation. No direct exclusions or prerequisites (e.g., requiring the secret key) are mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
7 tool updates
v0.3.1- First observed
generate_signed_request - First observed
get_endpoint - First observed
list_endpoints - First observed
list_error_codes - First observed
sign_request - First observed
signing_guide - First observed
verify_signature
TDQS
Scored across 7 tools
Each tool serves a distinct purpose: listing endpoints, getting details, error codes, signing guide, generating signed code, local signature computation, and signature verification. No overlap in functionality.
Most tools follow a clear verb_noun pattern (list_endpoints, get_endpoint, generate_signed_request, sign_request, verify_signature). The one deviation is 'signing_guide' which uses a gerund-noun form, but otherwise naming is uniform and predictable.
With 7 tools, the server is well-scoped for its purpose: providing API endpoint discovery, error handling, and request signing utilities. Each tool earns its place without being too many or too few.
The tool set covers the full workflow for an OpenAPI helper: discover endpoints, understand errors, learn signing, generate signed code, debug signature issues. No obvious gaps for its intended domain.
Maintenance
Related MCP Connectors
- mcpweaveOAuthcom.mcpweave
Korea-native MCP gateway: Korean commerce, payments, messaging, gov & finance APIs for AI agents.
Cloudflare Workers MCP server: govdata-korea
Unlock the power of real-time cryptocurrency data with our Crypto Price Insights MCP server.
The OpenZeppelin Solidity Contracts MCP server integrates OpenZeppelin's security and style rules into AI-driven development workflows, enabling AI assistants to generate safe, correct, and production-ready smart contracts. It automatically validates generated code against OpenZeppelin standards (including imports, modifiers, naming conventions, and security checks) and supports various contract types including ERC-20, ERC-721, ERC-1155, Stablecoins, RWA, Governor, and Account contracts through prompt-driven workflows.
Related MCP Servers
- AlicenseNot gradedqualityDmaintenanceAn MCP server that provides current and historical gold/precious metal prices (gold, silver, platinum, and palladium) via the GoldAPI.io service with support for multiple currencies.1MIT
- ISC
- FlicenseAqualityDmaintenanceAn MCP server that enables natural language control of Kiwoom Securities accounts through Claude Desktop. It provides tools for stock price lookup, buying and selling stocks, and analyzing portfolios or trade history via the Kiwoom REST API.112-
- AlicenseCqualityCmaintenanceSafe-by-default MCP server for the official Toss Securities Open API, providing read-only market and account data with optional order operations protected by multiple safety gates.27186 npm2MIT