keumbang/goldpopcon-openapi-mcp
@keumbang/goldpopcon-openapi-mcp
Servidor MCP de asistente de codificación para la API abierta de Goldpopcon (Keumbang). Se conecta a clientes MCP como Claude Code, Claude Desktop, Codex CLI, Gemini CLI, Cursor, etc., para ayudar a escribir código preciso para la integración con la API de comercio de oro y plata.
Emisión de clave API
La clave de API abierta (clave de acceso gpk_ + clave secreta sk_) se emite solo en la aplicación Goldpopcon. No hay una ruta de emisión web.
Instala la aplicación Goldpopcon — App Store · Google Play
Regístrate y emite la clave en el menú de API abierta dentro de la aplicación
La clave secreta
sk_solo se muestra en la pantalla de emisión — guárdala en un lugar seguro en ese momento
El punto donde los desarrolladores se atascan en esta API no es el nombre del campo, sino la firma de la solicitud — la entrada query_hash varía según el método (POST=cuerpo sin procesar, GET=querystring normalizada) y copiar el ejemplo de Upbit directamente da como resultado un 401. Este MCP genera el código para ese procedimiento y realiza la firma/verificación localmente.
Related MCP server: korea-stock-mcp
Herramientas
Herramienta | Propósito |
| Lista de endpoints — incluye alcance de permisos, idempotencia, bucket de tasa |
| Detalle de un solo endpoint — parámetros, esquema del cuerpo, ejemplos de solicitud/respuesta exitosa, códigos de respuesta |
| Tabla de códigos de error + juicio de reintento por código de estado + trampas (saldo insuficiente=400 P0001, fallo de autenticación=401 error:null) |
| Procedimiento de firma JWT — bifurcación de |
| Generación de código de solicitud firmada completa por lenguaje (python/javascript/go/curl) |
| Cálculo local de JWT con clave real (depuración) — devuelve JWT, query_hash, curl listo para usar |
| Verificación de un JWT ya creado en el mismo orden que el servidor — diagnóstico de causa de 401 |
| Llamada real — solo consulta, fijo en producción. Se registra solo cuando se activa con env |
Recursos: goldpopcon://openapi.yaml (especificación completa), goldpopcon://overview (prosa sobre firma, límites, errores).
Seguridad: La
secret_keypasada asign_request/verify_signature/call_apise usa solo para la firma local y solo se transmite el resultado de la firma (JWT) — el secreto en sí no viaja por la red.
call_api — Llamada en vivo solo de consulta
Desactivada por defecto. Solo se registra cuando GOLDPOPCON_MCP_ALLOW_LIVE=true. Cuádruple protección para bloquear por completo las transferencias de fondos:
Puerta env — sin la variable, la herramienta no existe
Lista blanca — solo
getPrices/getBalances/getPriceHistory/getOrderPreview/getTradeHistory.buy·sell·payout·virtual-accountsno están disponibles en vivo (solo generación de código)Fijo en producción — no se puede cambiar el servidor con argumentos. Como es solo de consulta, leer producción no mueve fondos
Forzar GET — bloquea métodos de escritura
Para llamar realmente a los endpoints de transferencia de fondos, recibe el código con generate_signed_request y ejecútalo en tu propio entorno de desarrollo.
Automatización de lectura — clave por env
Si el LLM automatiza la consulta repetitiva de precios/saldos, omite los argumentos accessKey/secretKey y proporciónalos por env. La sk_ pasada como argumento queda en texto plano en el contexto del modelo, la transcripción y los registros del cliente en cada llamada.
{
"mcpServers": {
"goldpopcon-openapi": {
"command": "npx",
"args": ["-y", "@keumbang/goldpopcon-openapi-mcp"],
"env": {
"GOLDPOPCON_MCP_ALLOW_LIVE": "true",
"GOLDPOPCON_ACCESS_KEY": "gpk_...",
"GOLDPOPCON_SECRET_KEY": "sk_..."
}
}
}
}El fallback de env solo existe para call_api (solo consulta). sign_request no se ha abierto porque puede crear firmas hasta para buyAsset — si se abriera, un agente podría generar firmas de transferencia de fondos válidas sin intervención humana.
call_api también responde con structuredContent — para usar los valores directamente sin analizar Markdown.
{
"operationId": "getPrices",
"url": "https://api.goldpopcon.com/api/open/v1/prices",
"status": 200,
"ok": true,
"data": { "...": "응답 본문 JSON 그대로" },
"rateLimit": { "limit": 600, "remaining": 599, "reset": 1730000000, "retryAfter": null }
}La forma de
datavaría según el endpoint — el ejemplo de respuesta exitosa deget_endpointes la especificación.Los errores 4xx/5xx también llegan como
status/ok, no como error de herramienta. El bucle los maneja por separado.El cuerpo que no es JSON (errores HTML de puerta de enlace, etc.) llega como
rawen lugar dedata.Si es 429,
rateLimit.retryAftercontiene los segundos de espera. Límite: 600 consultas/minuto, 60 operaciones/minuto.
Instalación · Compilación
git clone https://github.com/keumbang/goldpopcon-openapi-mcp.git
cd goldpopcon-openapi-mcp
npm install
npm run build # dist/ 생성
npm test # 서명 회귀 테스트Registro del cliente MCP
Clientes que se conectan con una sola línea de CLI:
# Claude Code
claude mcp add goldpopcon-openapi -- npx -y @keumbang/goldpopcon-openapi-mcp
# Codex CLI (~/.codex/config.toml 에 기록된다. 세션에서 /mcp 로 연결 확인)
codex mcp add goldpopcon-openapi -- npx -y @keumbang/goldpopcon-openapi-mcpEdición directa del archivo de configuración (Claude Desktop claude_desktop_config.json, Cursor ~/.cursor/mcp.json, Gemini CLI ~/.gemini/settings.json):
{ "mcpServers": { "goldpopcon-openapi": { "command": "npx", "args": ["-y", "@keumbang/goldpopcon-openapi-mcp"] } } }La resolución de PATH en Gemini CLI es inestable — si el servidor no arranca, cambia command por la ruta absoluta obtenida con which npx.
Ejecución con clon local:
{
"mcpServers": {
"goldpopcon-openapi": {
"command": "node",
"args": ["/절대경로/goldpopcon-openapi-mcp/dist/index.js"]
}
}
}Durante el desarrollo, usa command: "npx", args: ["tsx", "/ruta/absoluta/.../src/index.ts"].
Variables de entorno
Variable | Por defecto | Significado |
|
| Redirigir la ruta del archivo de especificación |
| (ninguno) | Si es |
| (ninguno) | Valor por defecto de la clave de acceso para |
| (ninguno) | Valor por defecto de la clave secreta para |
Ejemplos de diálogo
"Dame el código para llamar a sellAsset en Python, 0.5g de oro" →
generate_signed_request(operationId=sellAsset, language=python, pathParams={asset:gold}, body={quantity:0.5})"¿Cómo vender todo el oro que tengo?" →
generate_signed_request(operationId=sellAsset, language=python, pathParams={asset:gold}, body={quantity:0.001, sell_all:true})—sell_allignora la cantidad solicitada y ejecuta la totalidad del saldo disponible"¿Por qué este JWT da 401?" →
verify_signature(token=..., secretKey=..., method=POST, rawBody=...)"¿Qué parámetros tiene el endpoint de historial de precios?" →
get_endpoint(operationId=getPriceHistory)"Si es saldo insuficiente, ¿qué número de error es?" →
list_error_codes—400 P0001(no 500). También muestra la tabla de decisión de reintento por código de estado
Sincronización de la especificación
La fuente original de la especificación es docs/openapi.yaml en el repositorio del backend (fuera de este repo), y este repo incluye una copia en spec/openapi.yaml. Si la fuente cambia, actualízala especificando la ruta con SPEC_SRC:
SPEC_SRC=/path/to/<backend-repo>/docs/openapi.yaml npm run sync-specSPEC_SRC es obligatorio. Si se omite, no encontrará la fuente y fallará — no se ha establecido una ruta por defecto para no dejar el nombre del repositorio del backend en este repo.
Después de la actualización, confirma spec/openapi.yaml. Si las reglas de firma se desvían del servidor, npm test (que refleja las reglas de verificación del servidor) lo detectará.
<backend-repo>/docs/openapi.yaml ──sync-spec──▶ spec/openapi.yamlAvailable Tools
7 toolsgenerate_signed_requestB
특정 엔드포인트를 호출하는 완결형 서명 코드를 생성한다(python/javascript/go/curl). query_hash 분기·멱등성 헤더를 메서드에 맞게 자동 반영.
| Name | Required | Description | Default |
|---|---|---|---|
| body | No | POST 요청 본문 객체. 생략 시 스펙 예제 사용 | |
| query | No | GET 쿼리 파라미터 | |
| server | No | production | 임의 base url. 기본 production(스펙의 유일한 서버). 실거래 없이 시험하려면 server 가 아니라 operationId 를 demoBuyAsset/demoSellAsset 으로 바꾼다 | |
| language | Yes | 생성 언어 | |
| pathParams | No | 경로 파라미터. 예: {"asset":"gold"} (buy/sell) | |
| ttlSeconds | No | JWT 수명(초). 기본 30, 최대 60 | |
| operationId | Yes | operationId. 예: sellAsset, getPriceHistory |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses two behavioral traits: automatic handling of query_hash branching and idempotency headers. However, it does not mention that the generated code is a safe, read-only operation or what side effects (e.g., actual API calls) might occur. The disclosure is partial but not misleading.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the core purpose, and immediately followed by a key behavioral detail. Every sentence is meaningful and there is no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 7 parameters and no output schema, the description is too sparse. It does not explain what the tool returns (the generated code snippet), nor does it mention prerequisites (e.g., possession of API keys). The agent lacks critical context for invoking the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with detailed parameter descriptions. The description adds no extra parameter-level meaning beyond the schema; for example, it does not clarify how 'query_hash' or 'idempotency headers' relate to specific parameters. Baseline 3 is appropriate given the schema already does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb 'generates' and specifies the resource as 'complete signed code for calling specific endpoints', listing four languages. It clearly distinguishes from sibling tools like 'sign_request' (which signs an existing request) and 'verify_signature' (which verifies).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives such as 'sign_request' or 'signing_guide'. The description lacks explicit context for when-not-to-use or prerequisites, leaving the agent without decision criteria.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_endpointA
단일 엔드포인트 상세 — 설명, 파라미터, 요청 본문 스키마와 예제, 응답 상태, 권한·멱등성.
| Name | Required | Description | Default |
|---|---|---|---|
| operationId | Yes | operationId. 예: buyAsset, getPrices, getPriceHistory |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It discloses that the tool returns details on authorization and idempotency (권한·멱등성), but does not clarify if the operation is read-only, how it handles missing operationId (though required), or any rate limits. The exposure of idempotency info hints at safety but lacks comprehensive behavioral details.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence listing clearly what details are returned. It is front-loaded with the core purpose. Could be considered slightly dense due to the list of attributes, but overall efficient. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has only one required parameter with full schema coverage, no output schema, and the description lists all major return categories, it provides sufficient context for an agent to invoke it correctly. The lone missing piece is a mention of the return format (e.g., JSON), but the example-driven description compensates well.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so baseline is 3. The description adds the example value 'buyAsset, getPrices, getPriceHistory' for the operationId parameter, which is helpful but does not go beyond what the schema already provides (a string with description). No additional semantics beyond the parameter name and example.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description explicitly states '단일 엔드포인트 상세' (single endpoint details) and lists the specific attributes returned: 설명, 파라미터, 요청 본문 스키마와 예제, 응답 상태, 권한·멱등성. This clearly distinguishes it from sibling tool 'list_endpoints' which likely returns a list of endpoints rather than details for one.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies use when needing details of a specific endpoint by operationId. However, it does not explicitly contrast with alternatives like 'list_endpoints' (which lists all endpoints) or mention when not to use this tool (e.g., if you only need error codes, use 'list_error_codes' instead). The usage context is clear but lacks explicit exclusions or alternative guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_endpointsA
금방 Open API 엔드포인트 목록. 각 항목의 권한 스코프·멱등성 필요 여부·rate limit 버킷을 함께 준다.
| Name | Required | Description | Default |
|---|---|---|---|
| openApiOnly | No | true 면 /open/* 만. 기본 true — 현재 스펙은 전부 /open/* 이라 결과가 같다 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. It describes the output inclusions (scope, idempotency, rate limit) which is good, but does not disclose any behavioral traits such as caching, pagination, authentication requirements, or whether it is a safe read operation. Adequate but could be more transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, no wasted words. Front-loaded with the key verb 'list' and resource. Every sentence adds unique value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given only one simple boolean parameter and no output schema, the description is complete enough for a listing endpoint. It names the key output fields (scope, idempotency, rate limit bucket) which helps the agent understand what to expect. No missing critical information.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description adds minimal extra meaning beyond the schema's description of the boolean parameter, only restating that default is true and that all endpoints are currently /open/*. No additional clarity on parameter semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states it lists Open API endpoints and provides scope, idempotency, and rate limit info. It clearly specifies the resource ('Open API 엔드포인트 목록') and what each item includes, but does not explicitly distinguish from siblings like 'get_endpoint' or 'list_error_codes'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit when-to-use or when-not-to-use guidance is given, nor alternatives mentioned. The context of 'currently all /open/*' is helpful but does not guide the agent on when to prefer this over get_endpoint or other list tools. Implied usage for exploring endpoints, but lacks exclusions or prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_error_codesA
금방 Open API 에러 코드 표와 함정(잔액 부족은 400 P0001, 인증 실패는 error=null 401, 503 fail-closed 등). 상태 코드별 재시도 판단표 포함.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description fully bears the burden of behavioral disclosure. It explicitly discloses specific error code pitfalls (e.g., insufficient balance, authentication failure) and states the inclusion of a retry judgment table, which informs the agent of the tool's scope and limitations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very concise and front-loaded, but it uses a non-standard format (parenthetical examples, semicolons). The key information is present, but the structure could be clearer for an agent.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given zero parameters, no output schema, and no annotations, the description is complete. It explains the tool's purpose, lists concrete examples of what it reveals (specific error codes, pitfalls), and mentions the retry table. There are no gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters and schema description coverage is 100% (empty schema). The description adds no parameter information because none is needed. This is a baseline 4, upgraded to 5 because the description's content about error codes and retry table is exactly what the agent needs to know for this parameterless tool.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states what the tool does: it lists Open API error codes and common pitfalls (e.g., insufficient balance returns 400 P0001, authentication failure returns error=null 401, 503 fail-closed). This distinguishes it from siblings like list_endpoints or signing_guide.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description mentions it includes a retry judgment table by status code, implying it should be used for understanding error handling and retry logic. However, no explicit guidance is given on when to use this tool versus siblings like get_endpoint or signing_guide.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
signing_guideA
요청 서명(JWT + query_hash) 절차. 개발자가 가장 많이 막히는 지점 — 업비트 예제를 그대로 옮기면 전부 401 이 나는 이유 포함.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description must fully communicate behavioral traits. It describes the tool as a 'procedure' or guide, implying it is non-destructive and informational. It also adds context about debugging common signing errors. However, it does not explicitly state that the tool does not make API calls or have side effects, leaving minor ambiguity.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two concise sentences in Korean. The first sentence states the core purpose, and the second provides a critical usage hint (common failure point). No extraneous text; every sentence earns its place. It is front-loaded and efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no parameters and no output schema, the description adequately covers the tool's nature as a reference guide. It names the signing method (JWT + query_hash) and a specific error scenario. However, it does not describe the output format (e.g., return type or content structure), which could aid an agent in processing the result.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are zero parameters with 100% schema coverage, so the baseline is 4. The description does not need to explain parameters. It adds no parameter-specific information, but none is required. The description's focus on the signing guide content is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose as a procedure for request signing (JWT + query_hash). It also adds specific value by mentioning a common pitfall (401 errors when copying the Upbit example), which distinguishes it from sibling tools like sign_request that actually perform signing.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implicitly guides usage by highlighting the tool as a reference for developers stuck on 401 errors from copying examples. However, it does not explicitly state when not to use it (e.g., when actual signing is needed) or mention alternatives like generate_signed_request. The context provides some inference, but lacks direct exclusion.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sign_requestB
실제 키로 요청 하나의 JWT 를 로컬 계산한다(디버깅용). secret_key 는 로컬에서만 쓰이고 어디로도 전송되지 않는다. 결과에 JWT·query_hash·바로 쓸 curl 을 준다.
| Name | Required | Description | Default |
|---|---|---|---|
| body | No | POST 본문 객체. 생략 시 스펙 예제 | |
| query | No | ||
| server | No | production | 임의 base url. 기본 production(스펙의 유일한 서버). 실거래 없이 시험하려면 operationId 를 demoBuyAsset/demoSellAsset 으로 바꾼다 | |
| accessKey | Yes | gpk_... 액세스 키 | |
| secretKey | Yes | sk_... 시크릿 키. 로컬 계산에만 사용 | |
| pathParams | No | 경로 파라미터. 예: {"asset":"gold"} | |
| ttlSeconds | No | ||
| operationId | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full burden. It discloses that secret_key is not transmitted (local only), which is a key safety trait. However, it does not mention whether the tool makes any network calls, what happens on invalid keys or missing inputs, or any error behavior. The positive safety statement is useful but leaves several behavioral aspects undisclosed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three sentences long and front-loads the main purpose (local JWT computation for debugging). It is compact, uses simple language, and conveys key points without redundancy. A minor improvement could be structuring the output components as a list, but overall it is efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 8 parameters, nested objects, no output schema, and no annotations, the description provides core purpose and safety but lacks a complete usage story. It does not explain how to construct inputs (e.g., which operationId to use, how to fill pathParams), nor does it detail the output format beyond naming three components. The description partially compensates but leaves gaps for a full understanding.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already provides descriptions for 5 out of 8 parameters (63% coverage), including hints for 'body', 'server', 'accessKey', 'secretKey', and 'pathParams'. The description adds overall purpose and a safety note about secret key locality but does not add detailed semantics for individual parameters beyond what the schema states. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool computes a JWT locally for a single request using real keys (debugging purpose). It specifies the result includes JWT, query_hash, and a ready-to-use curl command. However, it does not explicitly differentiate from the sibling tool 'generate_signed_request' or other alternatives, so purpose is clear but not fully positioned among siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description marks the tool for debugging ('디버깅용') and emphasizes that the secret key is used only locally, implying it is safe for testing. However, it does not explicitly state when to use this tool versus alternatives like 'generate_signed_request' or 'verify_signature', nor does it mention prerequisites or exclusions. Usage context is implied but not fully explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
verify_signatureB
이미 만든 JWT 를 서버와 같은 순서로 로컬 검증해 401 원인을 짚는다. secret_key·전송할 본문/쿼리를 주면 query_hash 불일치까지 진단한다.
| Name | Required | Description | Default |
|---|---|---|---|
| query | No | 실제 전송한(할) 쿼리. GET 계열 대조용 | |
| token | Yes | 검증할 JWT(Bearer 접두사 있어도 됨) | |
| method | Yes | ||
| rawBody | No | 실제 전송한(할) 본문 raw 문자열. POST 계열 query_hash 대조용 | |
| secretKey | Yes | sk_... 시크릿 키 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description partially fulfills the behavioral transparency burden. It discloses that verification is local ('로컬') and can diagnose query_hash mismatches. However, it does not mention idempotency, side effects (e.g., no mutation), required permissions, or response format. The description adds some value but is not fully comprehensive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, dense sentence that packs purpose, method, and diagnostic scope without redundancy. It is front-loaded with the main action ('로컬 검증') and efficiently adds key constraints ('같은 순서로'). It could improve by breaking into two sentences for readability.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 5 parameters, no output schema, and no annotations, the description provides moderate coverage. It explains the diagnostic purpose and links two parameters to specific use cases, but omits mention of the 'method' parameter's role in verification logic, the 'token' prefix handling, and any post-verification output structure. Additional context on return values or errors would improve completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 80%, so the baseline is 3. The description adds context by linking 'query' (GET verification) and 'rawBody' (POST hash comparison) to use cases, which goes beyond the raw schema descriptions. However, the description does not explain the 'method' parameter's role in hash computation or the 'token' parameter's format tolerance beyond what the schema notes.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses specific verbs ('verify', 'diagnose') and resources ('JWT', 'query_hash'), clearly stating it validates a JWT locally and identifies 401 causes, including query_hash mismatches. It distinguishes from sibling tools like 'sign_request' and 'generate_signed_request' which focus on creation, not verification.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for debugging 401 errors and checking hash consistency, but does not explicitly state when to use this tool versus alternatives like 'signing_guide' for learning about signing, or 'list_error_codes' for error interpretation. No direct exclusions or prerequisites (e.g., requiring the secret key) are mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
7 tool updates
v0.3.1- First observed
generate_signed_request - First observed
get_endpoint - First observed
list_endpoints - First observed
list_error_codes - First observed
sign_request - First observed
signing_guide - First observed
verify_signature
TDQS
Scored across 7 tools
Each tool serves a distinct purpose: listing endpoints, getting details, error codes, signing guide, generating signed code, local signature computation, and signature verification. No overlap in functionality.
Most tools follow a clear verb_noun pattern (list_endpoints, get_endpoint, generate_signed_request, sign_request, verify_signature). The one deviation is 'signing_guide' which uses a gerund-noun form, but otherwise naming is uniform and predictable.
With 7 tools, the server is well-scoped for its purpose: providing API endpoint discovery, error handling, and request signing utilities. Each tool earns its place without being too many or too few.
The tool set covers the full workflow for an OpenAPI helper: discover endpoints, understand errors, learn signing, generate signed code, debug signature issues. No obvious gaps for its intended domain.
Maintenance
Related MCP Connectors
- mcpweaveOAuthcom.mcpweave
Korea-native MCP gateway: Korean commerce, payments, messaging, gov & finance APIs for AI agents.
Cloudflare Workers MCP server: govdata-korea
Unlock the power of real-time cryptocurrency data with our Crypto Price Insights MCP server.
The OpenZeppelin Solidity Contracts MCP server integrates OpenZeppelin's security and style rules into AI-driven development workflows, enabling AI assistants to generate safe, correct, and production-ready smart contracts. It automatically validates generated code against OpenZeppelin standards (including imports, modifiers, naming conventions, and security checks) and supports various contract types including ERC-20, ERC-721, ERC-1155, Stablecoins, RWA, Governor, and Account contracts through prompt-driven workflows.
Related MCP Servers
- AlicenseNot gradedqualityDmaintenanceAn MCP server that provides current and historical gold/precious metal prices (gold, silver, platinum, and palladium) via the GoldAPI.io service with support for multiple currencies.1MIT
- ISC
- FlicenseAqualityDmaintenanceAn MCP server that enables natural language control of Kiwoom Securities accounts through Claude Desktop. It provides tools for stock price lookup, buying and selling stocks, and analyzing portfolios or trade history via the Kiwoom REST API.112-
- AlicenseCqualityCmaintenanceSafe-by-default MCP server for the official Toss Securities Open API, providing read-only market and account data with optional order operations protected by multiple safety gates.27186 npm2MIT