Skip to main content
Glama
keumbang

keumbang/goldpopcon-openapi-mcp

@keumbang/goldpopcon-openapi-mcp

npm CI node license goldpopcon-openapi-mcp MCP server

VS Code 설치 Cursor 설치

골드팝콘(금방) Open API 코딩 어시스턴트 MCP 서버. Claude Code · Claude Desktop · Codex CLI · Gemini CLI · Cursor 등 MCP 클라이언트에 붙여, 금·은 거래 API 연동 코드를 정확히 짜도록 돕는다.

📘 골드팝콘 Open API 문서 → https://keumbang.github.io/goldpopcon-openapi-mcp/

엔드포인트 표 · 빠른 시작 · JWT 서명 규격 · 권한/한도 · 멱등성 · 에러 코드. 스펙에서 생성되는 공식 문서다. 요청·응답 스키마는 Redoc 에서 본다. MCP 없이 직접 연동할 사람도 여기부터 읽으면 된다. (repo 안에서 바로 보려면 docs/index.md)

API 키 발급

Open API 키(gpk_ 액세스 키 + sk_ 시크릿 키)는 골드팝콘 앱에서만 발급된다. 웹 발급 경로는 없다.

  1. 골드팝콘 앱 설치 — App Store · Google Play

  2. 회원가입 후 앱 내 Open API 메뉴에서 키 발급

  3. sk_ 시크릿 키는 발급 화면에서만 노출된다 — 그 자리에서 안전한 곳에 보관

이 API에서 개발자가 막히는 지점은 필드명이 아니라 요청 서명이다 — query_hash 입력이 메서드에 따라 갈리고(POST=raw body, GET=정규화 querystring) 업비트 예제를 그대로 옮기면 전부 401이 난다. 이 MCP는 그 절차를 코드로 생성하고 로컬에서 서명/검증까지 해준다.

Related MCP server: korea-stock-mcp

도구

도구

용도

list_endpoints

엔드포인트 목록 — 권한 스코프·멱등성·rate 버킷 포함

get_endpoint

단일 엔드포인트 상세 — 파라미터·본문 스키마·요청/성공 응답 예제·응답 코드

list_error_codes

에러 코드 표 + 상태 코드별 재시도 판단 + 함정(잔액 부족=400 P0001, 인증 실패=401 error:null)

signing_guide

JWT 서명 절차 — query_hash 분기·시각 클레임·nonce·멱등성

generate_signed_request

언어별(python/javascript/go/curl) 완결형 서명 요청 코드 생성

sign_request

실제 키로 JWT를 로컬 계산(디버깅) — JWT·query_hash·바로 쓸 curl 반환

verify_signature

이미 만든 JWT를 서버와 같은 순서로 검증 — 401 원인 진단

call_api (opt-in)

실제 호출 — 조회 전용·production 고정. env 로 켤 때만 등록

리소스: goldpopcon://openapi.yaml(전체 스펙), goldpopcon://overview(서명·한도·에러 산문).

보안: sign_request/verify_signature/call_api에 넘긴 secret_key는 로컬 서명에만 쓰이고 서명 결과(JWT)만 전송된다 — secret 자체는 네트워크를 타지 않는다.

call_api — 조회 전용 라이브 호출

기본 비활성. GOLDPOPCON_MCP_ALLOW_LIVE=true 일 때만 등록된다. 4중 안전장치로 자금 이동을 원천 차단:

  1. env 게이트 — 변수 없으면 도구 자체가 없다

  2. 화이트리스트getPrices / getBalances / getPriceHistory / getOrderPreview / getTradeHistory 만. buy·sell·payout·virtual-accounts 는 라이브 불가(코드 생성만)

  3. production 고정 — 인자로 서버를 바꿀 수 없다. 조회 전용이라 production 을 읽어도 자금은 움직이지 않는다

  4. GET 강제 — 쓰기 메서드 차단

자금 이동 엔드포인트를 실제로 호출하려면 generate_signed_request 로 코드를 받아 개발자 본인 환경에서 실행한다.

읽기 자동화 — 키는 env 로

LLM 이 시세·잔고를 반복 조회하는 자동화라면 accessKey/secretKey 인자를 생략하고 env 로 준다. 인자로 넘긴 sk_ 는 호출마다 모델 컨텍스트·트랜스크립트·클라이언트 로그에 평문으로 남는다.

{
  "mcpServers": {
    "goldpopcon-openapi": {
      "command": "npx",
      "args": ["-y", "@keumbang/goldpopcon-openapi-mcp"],
      "env": {
        "GOLDPOPCON_MCP_ALLOW_LIVE": "true",
        "GOLDPOPCON_ACCESS_KEY": "gpk_...",
        "GOLDPOPCON_SECRET_KEY": "sk_..."
      }
    }
  }
}

env fallback 은 call_api(조회 전용)에만 있다. sign_requestbuyAsset 서명까지 만들 수 있어 열지 않았다 — 열면 에이전트가 사람 개입 없이 유효한 자금 이동 서명을 찍어낸다.

call_apistructuredContent 로도 응답한다 — 마크다운 파싱 없이 값을 바로 쓴다.

{
  "operationId": "getPrices",
  "url": "https://api.goldpopcon.com/api/open/v1/prices",
  "status": 200,
  "ok": true,
  "data": { "...": "응답 본문 JSON 그대로" },
  "rateLimit": { "limit": 600, "remaining": 599, "reset": 1730000000, "retryAfter": null }
}
  • data 형태는 엔드포인트마다 다르다 — get_endpoint 의 성공 응답 예제가 스펙이다.

  • 4xx/5xx 도 도구 에러가 아니라 status/ok 로 온다. 루프가 분기해서 처리한다.

  • JSON 이 아닌 본문(게이트웨이 HTML 오류 등)은 data 대신 raw 로 온다.

  • 429 면 rateLimit.retryAfter 에 대기 초. quote 600/분, trade 60/분.

설치 · 빌드

git clone https://github.com/keumbang/goldpopcon-openapi-mcp.git
cd goldpopcon-openapi-mcp
npm install
npm run build       # dist/ 생성
npm test            # 서명 회귀 테스트

MCP 클라이언트 등록

CLI 한 줄로 붙는 클라이언트:

# Claude Code
claude mcp add goldpopcon-openapi -- npx -y @keumbang/goldpopcon-openapi-mcp

# Codex CLI  (~/.codex/config.toml 에 기록된다. 세션에서 /mcp 로 연결 확인)
codex mcp add goldpopcon-openapi -- npx -y @keumbang/goldpopcon-openapi-mcp

설정 파일 직접 편집(Claude Desktop claude_desktop_config.json, Cursor ~/.cursor/mcp.json, Gemini CLI ~/.gemini/settings.json):

{ "mcpServers": { "goldpopcon-openapi": { "command": "npx", "args": ["-y", "@keumbang/goldpopcon-openapi-mcp"] } } }

Gemini CLI 는 PATH 해석이 불안정하다 — 서버가 안 뜨면 commandwhich npx 로 얻은 절대경로로 바꾼다.

로컬 클론 실행:

{
  "mcpServers": {
    "goldpopcon-openapi": {
      "command": "node",
      "args": ["/절대경로/goldpopcon-openapi-mcp/dist/index.js"]
    }
  }
}

개발 중엔 command: "npx", args: ["tsx", "/절대경로/.../src/index.ts"].

환경변수

변수

기본

의미

GOLDPOPCON_OPENAPI_SPEC

번들 spec/openapi.yaml

스펙 파일 경로 재지정

GOLDPOPCON_MCP_ALLOW_LIVE

(없음)

truecall_api(조회 전용·production) 활성화

GOLDPOPCON_ACCESS_KEY

(없음)

call_api 액세스 키 기본값 — 인자 생략 시 사용

GOLDPOPCON_SECRET_KEY

(없음)

call_api 시크릿 키 기본값 — 반복 호출 자동화에서 권장

예시 대화

  • "sellAsset 을 파이썬으로 호출하는 코드 줘, 금 0.5g" → generate_signed_request(operationId=sellAsset, language=python, pathParams={asset:gold}, body={quantity:0.5})

  • "보유한 금 전부 팔려면?" → generate_signed_request(operationId=sellAsset, language=python, pathParams={asset:gold}, body={quantity:0.001, sell_all:true})sell_all 이 요청 수량을 무시하고 가용 잔량 전량을 체결한다

  • "이 JWT 가 왜 401 나?" → verify_signature(token=..., secretKey=..., method=POST, rawBody=...)

  • "가격 이력 엔드포인트 파라미터 뭐야?" → get_endpoint(operationId=getPriceHistory)

  • "잔액 부족이면 몇 번 에러야?" → list_error_codes400 P0001(500 아님). 상태 코드별 재시도 판단표도 같이 나온다

스펙 동기화

스펙 원본은 백엔드 repo 의 docs/openapi.yaml(이 repo 밖)이고, 이 repo 는 spec/openapi.yaml 사본을 번들한다. 원본이 바뀌면 SPEC_SRC 로 경로를 지정해 갱신한다:

SPEC_SRC=/path/to/<backend-repo>/docs/openapi.yaml npm run sync-spec

SPEC_SRC필수다. 생략하면 원본을 못 찾고 실패한다 — 백엔드 repo 명을 이 repo 에 남기지 않기 위해 기본 경로를 두지 않았다.

dist/ 가 있으면 sync-spec 이 문서 사이트(docs/index.md · docs/openapi.yaml)도 같이 다시 만든다. 스펙만 따로 갱신했다면 npm run docs 로 맞춘다 — 둘 다 생성물이라 직접 고치지 않는다. 문서 내용을 바꾸려면 백엔드 스펙의 info.description 을 고친다. 손으로 쓰는 파일은 docs/_config.ymldocs/redoc.html 둘뿐이다.

갱신 후 spec/openapi.yamldocs/ 를 커밋한다. main 에 푸시되면 GitHub Pages 가 사이트를 다시 배포한다. 서명 규칙이 서버와 어긋나면 npm test(서버 검증 규칙 미러)가 잡는다.

<backend-repo>/docs/openapi.yaml  ──sync-spec──▶  spec/openapi.yaml  ──gen-docs──▶  docs/  ──Pages──▶  keumbang.github.io

Available Tools

7 tools
generate_signed_requestB

특정 엔드포인트를 호출하는 완결형 서명 코드를 생성한다(python/javascript/go/curl). query_hash 분기·멱등성 헤더를 메서드에 맞게 자동 반영.

ParametersJSON Schema
NameRequiredDescriptionDefault
bodyNoPOST 요청 본문 객체. 생략 시 스펙 예제 사용
queryNoGET 쿼리 파라미터
serverNoproduction | 임의 base url. 기본 production(스펙의 유일한 서버). 실거래 없이 시험하려면 server 가 아니라 operationId 를 demoBuyAsset/demoSellAsset 으로 바꾼다
languageYes생성 언어
pathParamsNo경로 파라미터. 예: {"asset":"gold"} (buy/sell)
ttlSecondsNoJWT 수명(초). 기본 30, 최대 60
operationIdYesoperationId. 예: sellAsset, getPriceHistory

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses two behavioral traits: automatic handling of query_hash branching and idempotency headers. However, it does not mention that the generated code is a safe, read-only operation or what side effects (e.g., actual API calls) might occur. The disclosure is partial but not misleading.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with the core purpose, and immediately followed by a key behavioral detail. Every sentence is meaningful and there is no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With 7 parameters and no output schema, the description is too sparse. It does not explain what the tool returns (the generated code snippet), nor does it mention prerequisites (e.g., possession of API keys). The agent lacks critical context for invoking the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with detailed parameter descriptions. The description adds no extra parameter-level meaning beyond the schema; for example, it does not clarify how 'query_hash' or 'idempotency headers' relate to specific parameters. Baseline 3 is appropriate given the schema already does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb 'generates' and specifies the resource as 'complete signed code for calling specific endpoints', listing four languages. It clearly distinguishes from sibling tools like 'sign_request' (which signs an existing request) and 'verify_signature' (which verifies).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives such as 'sign_request' or 'signing_guide'. The description lacks explicit context for when-not-to-use or prerequisites, leaving the agent without decision criteria.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_endpointA

단일 엔드포인트 상세 — 설명, 파라미터, 요청 본문 스키마와 예제, 응답 상태, 권한·멱등성.

ParametersJSON Schema
NameRequiredDescriptionDefault
operationIdYesoperationId. 예: buyAsset, getPrices, getPriceHistory

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden. It discloses that the tool returns details on authorization and idempotency (권한·멱등성), but does not clarify if the operation is read-only, how it handles missing operationId (though required), or any rate limits. The exposure of idempotency info hints at safety but lacks comprehensive behavioral details.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence listing clearly what details are returned. It is front-loaded with the core purpose. Could be considered slightly dense due to the list of attributes, but overall efficient. No wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has only one required parameter with full schema coverage, no output schema, and the description lists all major return categories, it provides sufficient context for an agent to invoke it correctly. The lone missing piece is a mention of the return format (e.g., JSON), but the example-driven description compensates well.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so baseline is 3. The description adds the example value 'buyAsset, getPrices, getPriceHistory' for the operationId parameter, which is helpful but does not go beyond what the schema already provides (a string with description). No additional semantics beyond the parameter name and example.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description explicitly states '단일 엔드포인트 상세' (single endpoint details) and lists the specific attributes returned: 설명, 파라미터, 요청 본문 스키마와 예제, 응답 상태, 권한·멱등성. This clearly distinguishes it from sibling tool 'list_endpoints' which likely returns a list of endpoints rather than details for one.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies use when needing details of a specific endpoint by operationId. However, it does not explicitly contrast with alternatives like 'list_endpoints' (which lists all endpoints) or mention when not to use this tool (e.g., if you only need error codes, use 'list_error_codes' instead). The usage context is clear but lacks explicit exclusions or alternative guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_endpointsA

금방 Open API 엔드포인트 목록. 각 항목의 권한 스코프·멱등성 필요 여부·rate limit 버킷을 함께 준다.

ParametersJSON Schema
NameRequiredDescriptionDefault
openApiOnlyNotrue 면 /open/* 만. 기본 true — 현재 스펙은 전부 /open/* 이라 결과가 같다

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden. It describes the output inclusions (scope, idempotency, rate limit) which is good, but does not disclose any behavioral traits such as caching, pagination, authentication requirements, or whether it is a safe read operation. Adequate but could be more transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, no wasted words. Front-loaded with the key verb 'list' and resource. Every sentence adds unique value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given only one simple boolean parameter and no output schema, the description is complete enough for a listing endpoint. It names the key output fields (scope, idempotency, rate limit bucket) which helps the agent understand what to expect. No missing critical information.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description adds minimal extra meaning beyond the schema's description of the boolean parameter, only restating that default is true and that all endpoints are currently /open/*. No additional clarity on parameter semantics.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states it lists Open API endpoints and provides scope, idempotency, and rate limit info. It clearly specifies the resource ('Open API 엔드포인트 목록') and what each item includes, but does not explicitly distinguish from siblings like 'get_endpoint' or 'list_error_codes'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit when-to-use or when-not-to-use guidance is given, nor alternatives mentioned. The context of 'currently all /open/*' is helpful but does not guide the agent on when to prefer this over get_endpoint or other list tools. Implied usage for exploring endpoints, but lacks exclusions or prerequisites.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_error_codesA

금방 Open API 에러 코드 표와 함정(잔액 부족은 400 P0001, 인증 실패는 error=null 401, 503 fail-closed 등). 상태 코드별 재시도 판단표 포함.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description fully bears the burden of behavioral disclosure. It explicitly discloses specific error code pitfalls (e.g., insufficient balance, authentication failure) and states the inclusion of a retry judgment table, which informs the agent of the tool's scope and limitations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is very concise and front-loaded, but it uses a non-standard format (parenthetical examples, semicolons). The key information is present, but the structure could be clearer for an agent.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given zero parameters, no output schema, and no annotations, the description is complete. It explains the tool's purpose, lists concrete examples of what it reveals (specific error codes, pitfalls), and mentions the retry table. There are no gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters and schema description coverage is 100% (empty schema). The description adds no parameter information because none is needed. This is a baseline 4, upgraded to 5 because the description's content about error codes and retry table is exactly what the agent needs to know for this parameterless tool.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states what the tool does: it lists Open API error codes and common pitfalls (e.g., insufficient balance returns 400 P0001, authentication failure returns error=null 401, 503 fail-closed). This distinguishes it from siblings like list_endpoints or signing_guide.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description mentions it includes a retry judgment table by status code, implying it should be used for understanding error handling and retry logic. However, no explicit guidance is given on when to use this tool versus siblings like get_endpoint or signing_guide.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

signing_guideA

요청 서명(JWT + query_hash) 절차. 개발자가 가장 많이 막히는 지점 — 업비트 예제를 그대로 옮기면 전부 401 이 나는 이유 포함.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description must fully communicate behavioral traits. It describes the tool as a 'procedure' or guide, implying it is non-destructive and informational. It also adds context about debugging common signing errors. However, it does not explicitly state that the tool does not make API calls or have side effects, leaving minor ambiguity.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two concise sentences in Korean. The first sentence states the core purpose, and the second provides a critical usage hint (common failure point). No extraneous text; every sentence earns its place. It is front-loaded and efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no parameters and no output schema, the description adequately covers the tool's nature as a reference guide. It names the signing method (JWT + query_hash) and a specific error scenario. However, it does not describe the output format (e.g., return type or content structure), which could aid an agent in processing the result.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There are zero parameters with 100% schema coverage, so the baseline is 4. The description does not need to explain parameters. It adds no parameter-specific information, but none is required. The description's focus on the signing guide content is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose as a procedure for request signing (JWT + query_hash). It also adds specific value by mentioning a common pitfall (401 errors when copying the Upbit example), which distinguishes it from sibling tools like sign_request that actually perform signing.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implicitly guides usage by highlighting the tool as a reference for developers stuck on 401 errors from copying examples. However, it does not explicitly state when not to use it (e.g., when actual signing is needed) or mention alternatives like generate_signed_request. The context provides some inference, but lacks direct exclusion.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

sign_requestB

실제 키로 요청 하나의 JWT 를 로컬 계산한다(디버깅용). secret_key 는 로컬에서만 쓰이고 어디로도 전송되지 않는다. 결과에 JWT·query_hash·바로 쓸 curl 을 준다.

ParametersJSON Schema
NameRequiredDescriptionDefault
bodyNoPOST 본문 객체. 생략 시 스펙 예제
queryNo
serverNoproduction | 임의 base url. 기본 production(스펙의 유일한 서버). 실거래 없이 시험하려면 operationId 를 demoBuyAsset/demoSellAsset 으로 바꾼다
accessKeyYesgpk_... 액세스 키
secretKeyYessk_... 시크릿 키. 로컬 계산에만 사용
pathParamsNo경로 파라미터. 예: {"asset":"gold"}
ttlSecondsNo
operationIdYes

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries full burden. It discloses that secret_key is not transmitted (local only), which is a key safety trait. However, it does not mention whether the tool makes any network calls, what happens on invalid keys or missing inputs, or any error behavior. The positive safety statement is useful but leaves several behavioral aspects undisclosed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three sentences long and front-loads the main purpose (local JWT computation for debugging). It is compact, uses simple language, and conveys key points without redundancy. A minor improvement could be structuring the output components as a list, but overall it is efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has 8 parameters, nested objects, no output schema, and no annotations, the description provides core purpose and safety but lacks a complete usage story. It does not explain how to construct inputs (e.g., which operationId to use, how to fill pathParams), nor does it detail the output format beyond naming three components. The description partially compensates but leaves gaps for a full understanding.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already provides descriptions for 5 out of 8 parameters (63% coverage), including hints for 'body', 'server', 'accessKey', 'secretKey', and 'pathParams'. The description adds overall purpose and a safety note about secret key locality but does not add detailed semantics for individual parameters beyond what the schema states. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool computes a JWT locally for a single request using real keys (debugging purpose). It specifies the result includes JWT, query_hash, and a ready-to-use curl command. However, it does not explicitly differentiate from the sibling tool 'generate_signed_request' or other alternatives, so purpose is clear but not fully positioned among siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description marks the tool for debugging ('디버깅용') and emphasizes that the secret key is used only locally, implying it is safe for testing. However, it does not explicitly state when to use this tool versus alternatives like 'generate_signed_request' or 'verify_signature', nor does it mention prerequisites or exclusions. Usage context is implied but not fully explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

verify_signatureB

이미 만든 JWT 를 서버와 같은 순서로 로컬 검증해 401 원인을 짚는다. secret_key·전송할 본문/쿼리를 주면 query_hash 불일치까지 진단한다.

ParametersJSON Schema
NameRequiredDescriptionDefault
queryNo실제 전송한(할) 쿼리. GET 계열 대조용
tokenYes검증할 JWT(Bearer 접두사 있어도 됨)
methodYes
rawBodyNo실제 전송한(할) 본문 raw 문자열. POST 계열 query_hash 대조용
secretKeyYessk_... 시크릿 키

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description partially fulfills the behavioral transparency burden. It discloses that verification is local ('로컬') and can diagnose query_hash mismatches. However, it does not mention idempotency, side effects (e.g., no mutation), required permissions, or response format. The description adds some value but is not fully comprehensive.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, dense sentence that packs purpose, method, and diagnostic scope without redundancy. It is front-loaded with the main action ('로컬 검증') and efficiently adds key constraints ('같은 순서로'). It could improve by breaking into two sentences for readability.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 5 parameters, no output schema, and no annotations, the description provides moderate coverage. It explains the diagnostic purpose and links two parameters to specific use cases, but omits mention of the 'method' parameter's role in verification logic, the 'token' prefix handling, and any post-verification output structure. Additional context on return values or errors would improve completeness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 80%, so the baseline is 3. The description adds context by linking 'query' (GET verification) and 'rawBody' (POST hash comparison) to use cases, which goes beyond the raw schema descriptions. However, the description does not explain the 'method' parameter's role in hash computation or the 'token' parameter's format tolerance beyond what the schema notes.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses specific verbs ('verify', 'diagnose') and resources ('JWT', 'query_hash'), clearly stating it validates a JWT locally and identifies 401 causes, including query_hash mismatches. It distinguishes from sibling tools like 'sign_request' and 'generate_signed_request' which focus on creation, not verification.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for debugging 401 errors and checking hash consistency, but does not explicitly state when to use this tool versus alternatives like 'signing_guide' for learning about signing, or 'list_error_codes' for error interpretation. No direct exclusions or prerequisites (e.g., requiring the secret key) are mentioned.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 7 tool updatesv0.3.1
    • First observedgenerate_signed_request
    • First observedget_endpoint
    • First observedlist_endpoints
    • First observedlist_error_codes
    • First observedsign_request
    • First observedsigning_guide
    • First observedverify_signature

TDQS

A4/5.0

Scored across 7 tools

Disambiguation5/5

Each tool serves a distinct purpose: listing endpoints, getting details, error codes, signing guide, generating signed code, local signature computation, and signature verification. No overlap in functionality.

Naming Consistency4/5

Most tools follow a clear verb_noun pattern (list_endpoints, get_endpoint, generate_signed_request, sign_request, verify_signature). The one deviation is 'signing_guide' which uses a gerund-noun form, but otherwise naming is uniform and predictable.

Tool Count5/5

With 7 tools, the server is well-scoped for its purpose: providing API endpoint discovery, error handling, and request signing utilities. Each tool earns its place without being too many or too few.

Completeness5/5

The tool set covers the full workflow for an OpenAPI helper: discover endpoints, understand errors, learn signing, generate signed code, debug signature issues. No obvious gaps for its intended domain.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    D
    maintenance
    An MCP server that provides current and historical gold/precious metal prices (gold, silver, platinum, and palladium) via the GoldAPI.io service with support for multiple currencies.
    1
    MIT
  • F
    license
    A
    quality
    D
    maintenance
    An MCP server that enables natural language control of Kiwoom Securities accounts through Claude Desktop. It provides tools for stock price lookup, buying and selling stocks, and analyzing portfolios or trade history via the Kiwoom REST API.
    11
    2
    -
  • A
    license
    C
    quality
    B
    maintenance
    Safe-by-default MCP server for the official Toss Securities Open API, providing read-only market and account data with optional order operations protected by multiple safety gates.
    27
    10
    2
    MIT