Skip to main content
Glama
keumbang

keumbang/goldpopcon-openapi-mcp

@keumbang/goldpopcon-openapi-mcp

npm CI node license

Servidor MCP de asistente de codificación para la API abierta de Goldpopcon (Keumbang). Se conecta a clientes MCP como Claude Code, Claude Desktop, Codex CLI, Gemini CLI, Cursor, etc., para ayudar a escribir código preciso para la integración con la API de comercio de oro y plata.

Emisión de clave API

La clave de API abierta (clave de acceso gpk_ + clave secreta sk_) se emite solo en la aplicación Goldpopcon. No hay una ruta de emisión web.

  1. Instala la aplicación Goldpopcon — App Store · Google Play

  2. Regístrate y emite la clave en el menú de API abierta dentro de la aplicación

  3. La clave secreta sk_ solo se muestra en la pantalla de emisión — guárdala en un lugar seguro en ese momento

El punto donde los desarrolladores se atascan en esta API no es el nombre del campo, sino la firma de la solicitud — la entrada query_hash varía según el método (POST=cuerpo sin procesar, GET=querystring normalizada) y copiar el ejemplo de Upbit directamente da como resultado un 401. Este MCP genera el código para ese procedimiento y realiza la firma/verificación localmente.

Related MCP server: korea-stock-mcp

Herramientas

Herramienta

Propósito

list_endpoints

Lista de endpoints — incluye alcance de permisos, idempotencia, bucket de tasa

get_endpoint

Detalle de un solo endpoint — parámetros, esquema del cuerpo, ejemplos de solicitud/respuesta exitosa, códigos de respuesta

list_error_codes

Tabla de códigos de error + juicio de reintento por código de estado + trampas (saldo insuficiente=400 P0001, fallo de autenticación=401 error:null)

signing_guide

Procedimiento de firma JWT — bifurcación de query_hash, reclamo de tiempo, nonce, idempotencia

generate_signed_request

Generación de código de solicitud firmada completa por lenguaje (python/javascript/go/curl)

sign_request

Cálculo local de JWT con clave real (depuración) — devuelve JWT, query_hash, curl listo para usar

verify_signature

Verificación de un JWT ya creado en el mismo orden que el servidor — diagnóstico de causa de 401

call_api (opt-in)

Llamada real — solo consulta, fijo en producción. Se registra solo cuando se activa con env

Recursos: goldpopcon://openapi.yaml (especificación completa), goldpopcon://overview (prosa sobre firma, límites, errores).

Seguridad: La secret_key pasada a sign_request/verify_signature/call_api se usa solo para la firma local y solo se transmite el resultado de la firma (JWT) — el secreto en sí no viaja por la red.

call_api — Llamada en vivo solo de consulta

Desactivada por defecto. Solo se registra cuando GOLDPOPCON_MCP_ALLOW_LIVE=true. Cuádruple protección para bloquear por completo las transferencias de fondos:

  1. Puerta env — sin la variable, la herramienta no existe

  2. Lista blanca — solo getPrices / getBalances / getPriceHistory / getOrderPreview / getTradeHistory. buy·sell·payout·virtual-accounts no están disponibles en vivo (solo generación de código)

  3. Fijo en producción — no se puede cambiar el servidor con argumentos. Como es solo de consulta, leer producción no mueve fondos

  4. Forzar GET — bloquea métodos de escritura

Para llamar realmente a los endpoints de transferencia de fondos, recibe el código con generate_signed_request y ejecútalo en tu propio entorno de desarrollo.

Automatización de lectura — clave por env

Si el LLM automatiza la consulta repetitiva de precios/saldos, omite los argumentos accessKey/secretKey y proporciónalos por env. La sk_ pasada como argumento queda en texto plano en el contexto del modelo, la transcripción y los registros del cliente en cada llamada.

{
  "mcpServers": {
    "goldpopcon-openapi": {
      "command": "npx",
      "args": ["-y", "@keumbang/goldpopcon-openapi-mcp"],
      "env": {
        "GOLDPOPCON_MCP_ALLOW_LIVE": "true",
        "GOLDPOPCON_ACCESS_KEY": "gpk_...",
        "GOLDPOPCON_SECRET_KEY": "sk_..."
      }
    }
  }
}

El fallback de env solo existe para call_api (solo consulta). sign_request no se ha abierto porque puede crear firmas hasta para buyAsset — si se abriera, un agente podría generar firmas de transferencia de fondos válidas sin intervención humana.

call_api también responde con structuredContent — para usar los valores directamente sin analizar Markdown.

{
  "operationId": "getPrices",
  "url": "https://api.goldpopcon.com/api/open/v1/prices",
  "status": 200,
  "ok": true,
  "data": { "...": "응답 본문 JSON 그대로" },
  "rateLimit": { "limit": 600, "remaining": 599, "reset": 1730000000, "retryAfter": null }
}
  • La forma de data varía según el endpoint — el ejemplo de respuesta exitosa de get_endpoint es la especificación.

  • Los errores 4xx/5xx también llegan como status/ok, no como error de herramienta. El bucle los maneja por separado.

  • El cuerpo que no es JSON (errores HTML de puerta de enlace, etc.) llega como raw en lugar de data.

  • Si es 429, rateLimit.retryAfter contiene los segundos de espera. Límite: 600 consultas/minuto, 60 operaciones/minuto.

Instalación · Compilación

git clone https://github.com/keumbang/goldpopcon-openapi-mcp.git
cd goldpopcon-openapi-mcp
npm install
npm run build       # dist/ 생성
npm test            # 서명 회귀 테스트

Registro del cliente MCP

Clientes que se conectan con una sola línea de CLI:

# Claude Code
claude mcp add goldpopcon-openapi -- npx -y @keumbang/goldpopcon-openapi-mcp

# Codex CLI  (~/.codex/config.toml 에 기록된다. 세션에서 /mcp 로 연결 확인)
codex mcp add goldpopcon-openapi -- npx -y @keumbang/goldpopcon-openapi-mcp

Edición directa del archivo de configuración (Claude Desktop claude_desktop_config.json, Cursor ~/.cursor/mcp.json, Gemini CLI ~/.gemini/settings.json):

{ "mcpServers": { "goldpopcon-openapi": { "command": "npx", "args": ["-y", "@keumbang/goldpopcon-openapi-mcp"] } } }

La resolución de PATH en Gemini CLI es inestable — si el servidor no arranca, cambia command por la ruta absoluta obtenida con which npx.

Ejecución con clon local:

{
  "mcpServers": {
    "goldpopcon-openapi": {
      "command": "node",
      "args": ["/절대경로/goldpopcon-openapi-mcp/dist/index.js"]
    }
  }
}

Durante el desarrollo, usa command: "npx", args: ["tsx", "/ruta/absoluta/.../src/index.ts"].

Variables de entorno

Variable

Por defecto

Significado

GOLDPOPCON_OPENAPI_SPEC

spec/openapi.yaml empaquetado

Redirigir la ruta del archivo de especificación

GOLDPOPCON_MCP_ALLOW_LIVE

(ninguno)

Si es true, activa call_api (solo consulta, producción)

GOLDPOPCON_ACCESS_KEY

(ninguno)

Valor por defecto de la clave de acceso para call_api — se usa si se omite el argumento

GOLDPOPCON_SECRET_KEY

(ninguno)

Valor por defecto de la clave secreta para call_api — recomendado para automatización de llamadas repetitivas

  • "Dame el código para llamar a sellAsset en Python, 0.5g de oro" → generate_signed_request(operationId=sellAsset, language=python, pathParams={asset:gold}, body={quantity:0.5})

  • "¿Cómo vender todo el oro que tengo?" → generate_signed_request(operationId=sellAsset, language=python, pathParams={asset:gold}, body={quantity:0.001, sell_all:true}) — sell_all ignora la cantidad solicitada y ejecuta la totalidad del saldo disponible

  • "¿Por qué este JWT da 401?" → verify_signature(token=..., secretKey=..., method=POST, rawBody=...)

  • "¿Qué parámetros tiene el endpoint de historial de precios?" → get_endpoint(operationId=getPriceHistory)

  • "Si es saldo insuficiente, ¿qué número de error es?" → list_error_codes — 400 P0001 (no 500). También muestra la tabla de decisión de reintento por código de estado

Sincronización de la especificación

La fuente original de la especificación es docs/openapi.yaml en el repositorio del backend (fuera de este repo), y este repo incluye una copia en spec/openapi.yaml. Si la fuente cambia, actualízala especificando la ruta con SPEC_SRC:

SPEC_SRC=/path/to/<backend-repo>/docs/openapi.yaml npm run sync-spec

SPEC_SRC es obligatorio. Si se omite, no encontrará la fuente y fallará — no se ha establecido una ruta por defecto para no dejar el nombre del repositorio del backend en este repo.

Después de la actualización, confirma spec/openapi.yaml. Si las reglas de firma se desvían del servidor, npm test (que refleja las reglas de verificación del servidor) lo detectará.

<backend-repo>/docs/openapi.yaml  ──sync-spec──▶  spec/openapi.yaml

Available Tools

7 tools
generate_signed_requestB

특정 엔드포인트를 호출하는 완결형 서명 코드를 생성한다(python/javascript/go/curl). query_hash 분기·멱등성 헤더를 메서드에 맞게 자동 반영.

ParametersJSON Schema
NameRequiredDescriptionDefault
bodyNoPOST 요청 본문 객체. 생략 시 스펙 예제 사용
queryNoGET 쿼리 파라미터
serverNoproduction | 임의 base url. 기본 production(스펙의 유일한 서버). 실거래 없이 시험하려면 server 가 아니라 operationId 를 demoBuyAsset/demoSellAsset 으로 바꾼다
languageYes생성 언어
pathParamsNo경로 파라미터. 예: {"asset":"gold"} (buy/sell)
ttlSecondsNoJWT 수명(초). 기본 30, 최대 60
operationIdYesoperationId. 예: sellAsset, getPriceHistory

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses two behavioral traits: automatic handling of query_hash branching and idempotency headers. However, it does not mention that the generated code is a safe, read-only operation or what side effects (e.g., actual API calls) might occur. The disclosure is partial but not misleading.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with the core purpose, and immediately followed by a key behavioral detail. Every sentence is meaningful and there is no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With 7 parameters and no output schema, the description is too sparse. It does not explain what the tool returns (the generated code snippet), nor does it mention prerequisites (e.g., possession of API keys). The agent lacks critical context for invoking the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with detailed parameter descriptions. The description adds no extra parameter-level meaning beyond the schema; for example, it does not clarify how 'query_hash' or 'idempotency headers' relate to specific parameters. Baseline 3 is appropriate given the schema already does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb 'generates' and specifies the resource as 'complete signed code for calling specific endpoints', listing four languages. It clearly distinguishes from sibling tools like 'sign_request' (which signs an existing request) and 'verify_signature' (which verifies).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives such as 'sign_request' or 'signing_guide'. The description lacks explicit context for when-not-to-use or prerequisites, leaving the agent without decision criteria.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_endpointA

단일 엔드포인트 상세 — 설명, 파라미터, 요청 본문 스키마와 예제, 응답 상태, 권한·멱등성.

ParametersJSON Schema
NameRequiredDescriptionDefault
operationIdYesoperationId. 예: buyAsset, getPrices, getPriceHistory

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden. It discloses that the tool returns details on authorization and idempotency (권한·멱등성), but does not clarify if the operation is read-only, how it handles missing operationId (though required), or any rate limits. The exposure of idempotency info hints at safety but lacks comprehensive behavioral details.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence listing clearly what details are returned. It is front-loaded with the core purpose. Could be considered slightly dense due to the list of attributes, but overall efficient. No wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has only one required parameter with full schema coverage, no output schema, and the description lists all major return categories, it provides sufficient context for an agent to invoke it correctly. The lone missing piece is a mention of the return format (e.g., JSON), but the example-driven description compensates well.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so baseline is 3. The description adds the example value 'buyAsset, getPrices, getPriceHistory' for the operationId parameter, which is helpful but does not go beyond what the schema already provides (a string with description). No additional semantics beyond the parameter name and example.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description explicitly states '단일 엔드포인트 상세' (single endpoint details) and lists the specific attributes returned: 설명, 파라미터, 요청 본문 스키마와 예제, 응답 상태, 권한·멱등성. This clearly distinguishes it from sibling tool 'list_endpoints' which likely returns a list of endpoints rather than details for one.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies use when needing details of a specific endpoint by operationId. However, it does not explicitly contrast with alternatives like 'list_endpoints' (which lists all endpoints) or mention when not to use this tool (e.g., if you only need error codes, use 'list_error_codes' instead). The usage context is clear but lacks explicit exclusions or alternative guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_endpointsA

금방 Open API 엔드포인트 목록. 각 항목의 권한 스코프·멱등성 필요 여부·rate limit 버킷을 함께 준다.

ParametersJSON Schema
NameRequiredDescriptionDefault
openApiOnlyNotrue 면 /open/* 만. 기본 true — 현재 스펙은 전부 /open/* 이라 결과가 같다

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden. It describes the output inclusions (scope, idempotency, rate limit) which is good, but does not disclose any behavioral traits such as caching, pagination, authentication requirements, or whether it is a safe read operation. Adequate but could be more transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, no wasted words. Front-loaded with the key verb 'list' and resource. Every sentence adds unique value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given only one simple boolean parameter and no output schema, the description is complete enough for a listing endpoint. It names the key output fields (scope, idempotency, rate limit bucket) which helps the agent understand what to expect. No missing critical information.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description adds minimal extra meaning beyond the schema's description of the boolean parameter, only restating that default is true and that all endpoints are currently /open/*. No additional clarity on parameter semantics.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states it lists Open API endpoints and provides scope, idempotency, and rate limit info. It clearly specifies the resource ('Open API 엔드포인트 목록') and what each item includes, but does not explicitly distinguish from siblings like 'get_endpoint' or 'list_error_codes'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit when-to-use or when-not-to-use guidance is given, nor alternatives mentioned. The context of 'currently all /open/*' is helpful but does not guide the agent on when to prefer this over get_endpoint or other list tools. Implied usage for exploring endpoints, but lacks exclusions or prerequisites.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_error_codesA

금방 Open API 에러 코드 표와 함정(잔액 부족은 400 P0001, 인증 실패는 error=null 401, 503 fail-closed 등). 상태 코드별 재시도 판단표 포함.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description fully bears the burden of behavioral disclosure. It explicitly discloses specific error code pitfalls (e.g., insufficient balance, authentication failure) and states the inclusion of a retry judgment table, which informs the agent of the tool's scope and limitations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is very concise and front-loaded, but it uses a non-standard format (parenthetical examples, semicolons). The key information is present, but the structure could be clearer for an agent.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given zero parameters, no output schema, and no annotations, the description is complete. It explains the tool's purpose, lists concrete examples of what it reveals (specific error codes, pitfalls), and mentions the retry table. There are no gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters and schema description coverage is 100% (empty schema). The description adds no parameter information because none is needed. This is a baseline 4, upgraded to 5 because the description's content about error codes and retry table is exactly what the agent needs to know for this parameterless tool.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states what the tool does: it lists Open API error codes and common pitfalls (e.g., insufficient balance returns 400 P0001, authentication failure returns error=null 401, 503 fail-closed). This distinguishes it from siblings like list_endpoints or signing_guide.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description mentions it includes a retry judgment table by status code, implying it should be used for understanding error handling and retry logic. However, no explicit guidance is given on when to use this tool versus siblings like get_endpoint or signing_guide.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

signing_guideA

요청 서명(JWT + query_hash) 절차. 개발자가 가장 많이 막히는 지점 — 업비트 예제를 그대로 옮기면 전부 401 이 나는 이유 포함.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description must fully communicate behavioral traits. It describes the tool as a 'procedure' or guide, implying it is non-destructive and informational. It also adds context about debugging common signing errors. However, it does not explicitly state that the tool does not make API calls or have side effects, leaving minor ambiguity.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two concise sentences in Korean. The first sentence states the core purpose, and the second provides a critical usage hint (common failure point). No extraneous text; every sentence earns its place. It is front-loaded and efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no parameters and no output schema, the description adequately covers the tool's nature as a reference guide. It names the signing method (JWT + query_hash) and a specific error scenario. However, it does not describe the output format (e.g., return type or content structure), which could aid an agent in processing the result.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There are zero parameters with 100% schema coverage, so the baseline is 4. The description does not need to explain parameters. It adds no parameter-specific information, but none is required. The description's focus on the signing guide content is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose as a procedure for request signing (JWT + query_hash). It also adds specific value by mentioning a common pitfall (401 errors when copying the Upbit example), which distinguishes it from sibling tools like sign_request that actually perform signing.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implicitly guides usage by highlighting the tool as a reference for developers stuck on 401 errors from copying examples. However, it does not explicitly state when not to use it (e.g., when actual signing is needed) or mention alternatives like generate_signed_request. The context provides some inference, but lacks direct exclusion.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

sign_requestB

실제 키로 요청 하나의 JWT 를 로컬 계산한다(디버깅용). secret_key 는 로컬에서만 쓰이고 어디로도 전송되지 않는다. 결과에 JWT·query_hash·바로 쓸 curl 을 준다.

ParametersJSON Schema
NameRequiredDescriptionDefault
bodyNoPOST 본문 객체. 생략 시 스펙 예제
queryNo
serverNoproduction | 임의 base url. 기본 production(스펙의 유일한 서버). 실거래 없이 시험하려면 operationId 를 demoBuyAsset/demoSellAsset 으로 바꾼다
accessKeyYesgpk_... 액세스 키
secretKeyYessk_... 시크릿 키. 로컬 계산에만 사용
pathParamsNo경로 파라미터. 예: {"asset":"gold"}
ttlSecondsNo
operationIdYes

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries full burden. It discloses that secret_key is not transmitted (local only), which is a key safety trait. However, it does not mention whether the tool makes any network calls, what happens on invalid keys or missing inputs, or any error behavior. The positive safety statement is useful but leaves several behavioral aspects undisclosed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three sentences long and front-loads the main purpose (local JWT computation for debugging). It is compact, uses simple language, and conveys key points without redundancy. A minor improvement could be structuring the output components as a list, but overall it is efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has 8 parameters, nested objects, no output schema, and no annotations, the description provides core purpose and safety but lacks a complete usage story. It does not explain how to construct inputs (e.g., which operationId to use, how to fill pathParams), nor does it detail the output format beyond naming three components. The description partially compensates but leaves gaps for a full understanding.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already provides descriptions for 5 out of 8 parameters (63% coverage), including hints for 'body', 'server', 'accessKey', 'secretKey', and 'pathParams'. The description adds overall purpose and a safety note about secret key locality but does not add detailed semantics for individual parameters beyond what the schema states. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool computes a JWT locally for a single request using real keys (debugging purpose). It specifies the result includes JWT, query_hash, and a ready-to-use curl command. However, it does not explicitly differentiate from the sibling tool 'generate_signed_request' or other alternatives, so purpose is clear but not fully positioned among siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description marks the tool for debugging ('디버깅용') and emphasizes that the secret key is used only locally, implying it is safe for testing. However, it does not explicitly state when to use this tool versus alternatives like 'generate_signed_request' or 'verify_signature', nor does it mention prerequisites or exclusions. Usage context is implied but not fully explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

verify_signatureB

이미 만든 JWT 를 서버와 같은 순서로 로컬 검증해 401 원인을 짚는다. secret_key·전송할 본문/쿼리를 주면 query_hash 불일치까지 진단한다.

ParametersJSON Schema
NameRequiredDescriptionDefault
queryNo실제 전송한(할) 쿼리. GET 계열 대조용
tokenYes검증할 JWT(Bearer 접두사 있어도 됨)
methodYes
rawBodyNo실제 전송한(할) 본문 raw 문자열. POST 계열 query_hash 대조용
secretKeyYessk_... 시크릿 키

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description partially fulfills the behavioral transparency burden. It discloses that verification is local ('로컬') and can diagnose query_hash mismatches. However, it does not mention idempotency, side effects (e.g., no mutation), required permissions, or response format. The description adds some value but is not fully comprehensive.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, dense sentence that packs purpose, method, and diagnostic scope without redundancy. It is front-loaded with the main action ('로컬 검증') and efficiently adds key constraints ('같은 순서로'). It could improve by breaking into two sentences for readability.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 5 parameters, no output schema, and no annotations, the description provides moderate coverage. It explains the diagnostic purpose and links two parameters to specific use cases, but omits mention of the 'method' parameter's role in verification logic, the 'token' prefix handling, and any post-verification output structure. Additional context on return values or errors would improve completeness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 80%, so the baseline is 3. The description adds context by linking 'query' (GET verification) and 'rawBody' (POST hash comparison) to use cases, which goes beyond the raw schema descriptions. However, the description does not explain the 'method' parameter's role in hash computation or the 'token' parameter's format tolerance beyond what the schema notes.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses specific verbs ('verify', 'diagnose') and resources ('JWT', 'query_hash'), clearly stating it validates a JWT locally and identifies 401 causes, including query_hash mismatches. It distinguishes from sibling tools like 'sign_request' and 'generate_signed_request' which focus on creation, not verification.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for debugging 401 errors and checking hash consistency, but does not explicitly state when to use this tool versus alternatives like 'signing_guide' for learning about signing, or 'list_error_codes' for error interpretation. No direct exclusions or prerequisites (e.g., requiring the secret key) are mentioned.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 7 tool updatesv0.3.1
    • First observedgenerate_signed_request
    • First observedget_endpoint
    • First observedlist_endpoints
    • First observedlist_error_codes
    • First observedsign_request
    • First observedsigning_guide
    • First observedverify_signature

TDQS

A4/5.0

Scored across 7 tools

Disambiguation5/5

Each tool serves a distinct purpose: listing endpoints, getting details, error codes, signing guide, generating signed code, local signature computation, and signature verification. No overlap in functionality.

Naming Consistency4/5

Most tools follow a clear verb_noun pattern (list_endpoints, get_endpoint, generate_signed_request, sign_request, verify_signature). The one deviation is 'signing_guide' which uses a gerund-noun form, but otherwise naming is uniform and predictable.

Tool Count5/5

With 7 tools, the server is well-scoped for its purpose: providing API endpoint discovery, error handling, and request signing utilities. Each tool earns its place without being too many or too few.

Completeness5/5

The tool set covers the full workflow for an OpenAPI helper: discover endpoints, understand errors, learn signing, generate signed code, debug signature issues. No obvious gaps for its intended domain.

Maintenance

ActivitySlowing
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    D
    maintenance
    An MCP server that provides current and historical gold/precious metal prices (gold, silver, platinum, and palladium) via the GoldAPI.io service with support for multiple currencies.
    1
    MIT
  • F
    license
    A
    quality
    D
    maintenance
    An MCP server that enables natural language control of Kiwoom Securities accounts through Claude Desktop. It provides tools for stock price lookup, buying and selling stocks, and analyzing portfolios or trade history via the Kiwoom REST API.
    11
    2
    -
  • A
    license
    C
    quality
    C
    maintenance
    Safe-by-default MCP server for the official Toss Securities Open API, providing read-only market and account data with optional order operations protected by multiple safety gates.
    27
    186 npm
    2
    MIT