iiko-mcp
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@iiko-mcpWhat are my organizations in iiko?"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
iiko-mcp
MCP-сервер для ручной отладки запросов к iikoTransport API
(api-ru.iiko.services). Подключается к любому MCP-клиенту (Cursor, Claude
Desktop, Claude Code) и даёт инструменты, чтобы дёргать эндпоинты iiko и смотреть
сырые ответы — со своими кредами.
EN: An MCP server for debugging iikoTransport API requests. Bring your own credentials, plug it into any MCP client, and call iiko endpoints interactively.
Авторизация — v2 (POST /api/v2/access_token с apiKey/appId/clientSecret,
JWT на 1 час, кэшируется в памяти). Старый /api/1/access_token отключается iiko.
Быстрый старт
git clone https://github.com/steamn/iiko-mcp.git
cd iiko-mcp
npm install
npm run buildДальше — задать креды (см. ниже) и подключить в MCP-клиенте.
Related MCP server: mcp-server-apidebug
Креды
Получаются один раз:
Зарегистрируй приложение на портале разработчика iiko — https://public-api.iikoweb.ru/portal. Получишь
appIdи одноразовыйclientSecret.В iikoWeb → Интеграции → API-ключи сгенерируй API-ключ (
apiKey).
Переменная окружения | Значение |
|
|
|
|
|
|
| необязательно, по умолчанию |
| необязательно, по умолчанию |
Есть два способа передать креды:
через MCP-клиент — в блоке
envконфига (примеры ниже);через
.env-файл — скопируй.env.exampleв.env, заполни и запускайnode --env-file=.env dist/index.js.
.env в .gitignore — секреты в репозиторий не попадут.
Инструменты
Инструмент | Назначение |
| Универсальный: любой метод + путь + тело, авто-авторизация → статус, correlationId, тело |
| Получить/обновить токен (для отладки авторизации) |
|
|
|
|
|
|
|
|
iiko_request — главный: им можно вызвать любой эндпоинт из
документации iiko, даже если готового шортката нет.
Подключение
Cursor — .cursor/mcp.json
{
"mcpServers": {
"iiko": {
"command": "node",
"args": ["/absolute/path/to/iiko-mcp/dist/index.js"],
"env": {
"IIKO_API_LOGIN": "your-api-key",
"IIKO_APP_ID": "your-app-id",
"IIKO_CLIENT_SECRET": "your-client-secret"
}
}
}
}Claude Desktop — claude_desktop_config.json
Тот же блок mcpServers. После правки конфига перезапусти клиент — инструменты
iiko_* появятся в списке.
Безопасность
Никогда не коммить реальные
clientSecret/apiKey. Держи их в.env(он в.gitignore) или в конфиге MCP-клиента вне репозитория.Если секрет утёк — перевыпусти его на портале разработчика, старый отзовётся.
Разработка
npm run dev # tsc --watchPR и issue приветствуются.
Лицензия
MIT © steamn
Available Tools
6 toolsiiko_access_tokeniiko: получить токенA
Получить (или принудительно обновить) access_token v2. Полезно для отладки авторизации: показывает выданный JWT.
| Name | Required | Description | Default |
|---|---|---|---|
| force | No | Игнорировать кэш и запросить новый токен | |
| apiLogin | No | apiLogin (apiKey). Пусто — IIKO_API_LOGIN. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the burden. It discloses important behaviors: the ability to forcibly refresh (implying caching) and the output of an issued JWT. It does not mention side effects like external API calls, but for a token retrieval tool this is reasonably transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two short sentences, front-loaded with the core action and followed by the use case. Every word contributes to understanding the tool's purpose and behavior, with no unnecessary repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with two optional parameters and no output schema, the description covers purpose, use case, behaviors (caching/force), and output format. It is sufficiently complete without needing to explain return values or complex side effects.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and both parameters (force and apiLogin) are already well-defined in the schema. The description does not add extra parameter-level meaning beyond what the schema provides, so a baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description explicitly states the action: 'Получить (или принудительно обновить) access_token v2' (get or forcibly refresh access_token v2), identifying both the verb and the resource. It also notes a specific use case (debugging authorization) and output type (JWT), clearly distinguishing it from sibling tools like iiko_organizations or iiko_nomenclature.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides a clear context of use: 'Полезно для отладки авторизации' (useful for debugging authorization). It does not explicitly mention when not to use it or name alternatives, but the purpose is narrow and the sibling tools do not overlap, so the guidance is adequate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
iiko_deliveries_by_idiiko: статус доставокC
Статус доставок по orderIds (POST /api/1/deliveries/by_id).
| Name | Required | Description | Default |
|---|---|---|---|
| apiLogin | No | ||
| orderIds | Yes | Идентификаторы заказов iiko | |
| organizationId | Yes | Идентификатор организации iiko |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description bears full responsibility for disclosing behavior. It only mentions the POST endpoint, omitting response format, error handling, authentication needs, and whether the operation is read-only.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise phrase with zero wasted words, making it highly efficient and easy to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Without an output schema or annotations, the tool is under-specified. The description does not explain the nature of the delivery statuses returned or any edge cases, leaving the agent uncertain about the outcome.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description repeats the orderIds parameter but adds no additional meaning. The schema already covers orderIds and organizationId, but apiLogin remains undocumented, and the description does not clarify usage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states that the tool returns delivery status by order IDs and names the specific API endpoint. It distinguishes itself from sibling tools by focusing on deliveries, though it lacks a direct imperative verb.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no guidance on when to use this tool versus alternatives like iiko_request, and no context about prerequisites or conditions that would drive selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
iiko_nomenclatureiiko: меню/номенклатураC
Меню организации (POST /api/1/nomenclature).
| Name | Required | Description | Default |
|---|---|---|---|
| apiLogin | No | ||
| organizationId | Yes | Идентификатор организации iiko |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It only mentions a POST endpoint, but does not clarify whether this is a read-only operation, whether authentication is necessary, or what the response looks like. The agent is left without critical behavioral information.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise: a single phrase with no filler words. It efficiently conveys the resource and endpoint, so it earns a perfect score for conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with no annotations, no output schema, and minimal schema descriptions, the tool description is very thin. It does not describe the return value, data format, or any prerequisites, leaving significant gaps for an AI agent attempting to invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has only 2 parameters, with organizationId described but apiLogin not. The description adds no parameter information, failing to compensate for the 50% schema description coverage. It does not explain how the parameters map to the menu retrieval.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Organization's menu (POST /api/1/nomenclature)' clearly identifies the resource (menu/nomenclature) and provides the specific endpoint, which is specific enough to infer the tool's scope. However, it lacks an explicit verb like 'get' or 'retrieve', and it does not differentiate from sibling tools like iiko_request, so it is not a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no guidance on when to use this tool versus alternatives such as iiko_request or iiko_organizations. It is just a noun phrase with no context, exclusions, or alternative references. This is essentially no usage guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
iiko_organizationsiiko: организацииA
Список организаций (POST /api/1/organizations). Возвращает organizationId для остальных вызовов.
| Name | Required | Description | Default |
|---|---|---|---|
| apiLogin | No | apiLogin (apiKey). Пусто — IIKO_API_LOGIN. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must carry the behavioral transparency burden. It discloses the endpoint and mentions the return value (organizationId), but does not explicitly state side effects, authentication requirements, or response format. The 'list' action implies read-only, but this is not made explicit.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise, consisting of a single sentence that front-loads the primary purpose ('List of organizations') and then adds the key return-value context. Every part is essential and there is no wasted text.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with one optional parameter and no output schema, the description is largely complete: it states what it does and why the return value matters. A minor gap is the lack of explicit detail about the full response structure, but the provided information is sufficient for its intended use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% since the only parameter (apiLogin) is fully described in the schema. The tool description does not mention apiLogin or add any additional meaning beyond what the schema provides, so it meets the baseline for high coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'List of organizations' and specifies the endpoint 'POST /api/1/organizations', which is a specific verb+resource. It distinguishes itself from sibling tools by focusing on the organization entity and notes its role in providing organizationId for other calls.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'Возвращает organizationId для остальных вызовов' indicates that this tool is a prerequisite for other calls by providing the organizationId. This gives clear contextual guidance on when to use it, though it does not explicitly name alternatives or state when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
iiko_requestiiko: произвольный запросA
Универсальный отладочный вызов iiko API: любой метод и путь с автоматической v2-авторизацией. Возвращает HTTP-статус, correlationId и тело ответа. Пример: method=POST, path=/api/1/organizations, body={}.
| Name | Required | Description | Default |
|---|---|---|---|
| body | No | JSON-тело запроса (для POST/PUT) | |
| path | Yes | Путь эндпоинта, например /api/1/nomenclature | |
| method | No | HTTP-метод | POST |
| apiLogin | No | apiLogin (apiKey) конкретной точки. Пусто — берётся IIKO_API_LOGIN. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It discloses that it returns HTTP status, correlationId, and response body, and mentions automatic v2 authorization. This provides key behavioral context beyond the schema, though it does not cover error handling or side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise, with two sentences plus an example. It is front-loaded with the core purpose and includes all essential information without fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is a generic HTTP caller with four parameters and no output schema. The description explains return values and auth, and provides an example. It is mostly complete, though it does not elaborate on error handling or how auth credentials are resolved for apiLogin.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already describes all four parameters (100% coverage), so baseline is 3. The description adds value with an example (method=POST, path=/api/1/organizations, body={}) and the statement 'any method and path', which clarifies usage beyond the schema's individual descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states this is a universal debug call to the iiko API with any method and path, which distinguishes it from the specific sibling tools. The verb 'вызов' (call) and resource 'iiko API' make the purpose explicit.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for debugging or arbitrary requests via 'универсальный отладочный вызов', but it does not explicitly mention when to use this instead of the specific sibling tools, nor does it provide exclusions or alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
iiko_stop_listsiiko: стоп-листыC
Стоп-листы по организациям (POST /api/1/stop_lists).
| Name | Required | Description | Default |
|---|---|---|---|
| apiLogin | No | ||
| organizationIds | Yes | Идентификаторы организаций |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description does not disclose any behavioral traits beyond the endpoint. It omits whether this is a read-only query (despite POST), what it returns, whether authentication is needed, or any side effects. With no annotations provided, the description carries the full burden and fails entirely.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely terse, but this under-specification is not appropriate conciseness. It is a noun fragment without a predicate, lacking essential context such as the action performed. It could be equally concise and informative with a verb.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 2-parameter tool with no annotations and no output schema, the description is severely incomplete. It does not state what the tool does, when to use it, what it returns, or any side effects. Sibling differentiation is absent, making it nearly impossible to invoke correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds no meaning to the parameters. Schema covers only organizationIds (50% coverage), leaving apiLogin undocumented. The description does not name or explain any parameter, so it fails to compensate for the gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Стоп-листы по организациям (POST /api/1/stop_lists)' identifies the resource (stop lists) and the endpoint, but lacks a clear verb such as 'get', 'list', or 'create'. It is distinguishable from siblings by noun phrase alone, but the intended action is ambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided about when to use this tool over alternatives like iiko_organizations or iiko_request. There is no mention of prerequisites, typical scenarios, or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
TDQS
The tools are mostly distinct resources, but the universal iiko_request overlaps with every specific wrapper, creating potential confusion about which to use. Although iiko_request is clearly for debugging, an agent might still misselect it for a routine operation.
All tool names follow a consistent snake_case convention with the iiko_ prefix, and they all use noun-like resource names. The naming pattern is uniform and predictable across the set.
Six tools is a well-scoped number for an API integration server, covering core resources with a generic fallback. It is within the ideal 3-15 range and each tool earns its place.
The specialized tools cover the primary endpoints (organizations, nomenclature, stop lists, deliveries), and the iiko_request tool provides a catch-all for any other API operation. This ensures no functional gaps or dead ends.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
MCP server for AI access to Swagger by SmartBear.
MCP server that delivers up-to-date Bitrix24 REST API documentation.
A paid remote MCP for hosted MCP server, built to return verdicts, receipts, usage logs, and audit-r
MCP server for Vonage API documentation, code snippets, tutorials, and troubleshooting.
Related MCP Servers
- AlicenseAqualityCmaintenanceMCP server that provides tools for exploring and testing APIs through Swagger/OpenAPI documentation.521412MIT
- AlicenseAqualityDmaintenanceA standalone MCP server for API debugging, login authentication, API configuration management, and indexed API execution.515MIT
- AlicenseAqualityBmaintenanceAn MCP server that helps you build against the Partner Center REST API, providing scenario discovery, REST examples, authentication guidance, and error decoding without making live API calls.291332MIT
- FlicenseNot gradedqualityDmaintenanceMCP server for making API calls with authentication support. Allows configuring multiple API endpoints and performing GET, POST, PUT, DELETE requests, including form data and file uploads.
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/steamn/iiko-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server