@theyahia/chestnyznak-mcp

MCP server for the «Честный ЗНАК» / ЦРПТ API — product marking verification. 5 tools. Public checks without authorization, information from True API with a token.

Part of the Russian API MCP series (50 servers) by @theYahia.

Installation

Claude Desktop

{
  "mcpServers": {
    "chestnyznak": {
      "command": "npx",
      "args": ["-y", "@theyahia/chestnyznak-mcp"]
    }
  }
}

Claude Desktop (with authorization)

{
  "mcpServers": {
    "chestnyznak": {
      "command": "npx",
      "args": ["-y", "@theyahia/chestnyznak-mcp"],
      "env": {
        "CHESTNYZNAK_TOKEN": "ваш-токен"
      }
    }
  }
}

Claude Code

claude mcp add chestnyznak -- npx -y @theyahia/chestnyznak-mcp

# С авторизацией
CHESTNYZNAK_TOKEN=ваш-токен claude mcp add chestnyznak -- npx -y @theyahia/chestnyznak-mcp

Streamable HTTP

npx @theyahia/chestnyznak-mcp --http --port=3000
# Endpoint: POST http://127.0.0.1:3000/mcp
# Health:   GET  http://127.0.0.1:3000/health

By default, the HTTP server listens only on 127.0.0.1 and checks the Host header (protection against DNS-rebinding). To expose it externally — --host=0.0.0.0 (at your own risk, there is no authentication on /mcp).

Related MCP server: nip-checker-mcp

Environment variables

Tools (5)

Public (no authorization)

codeType — datamatrix (default), qr or ean13.

Authorized (CHESTNYZNAK_TOKEN)

Search by name/brand is the National Catalog (nk.crpt.ru), a separate API; it is not supported here. search_products works by GTIN.

Response format

check_marking_code:

{ "code": "0104600702028445", "found": true, "valid": true, "status": "INTRODUCED" }

get_product_info (the producer/owner/status fields are taken from the nested product group object, null if absent):

{
  "code": "0104600702028445",
  "found": true,
  "valid": true,
  "status": "INTRODUCED",
  "productName": "Молоко 3.2%",
  "category": "milk",
  "producerName": "АО \"Данон Россия\"",
  "ownerName": "ООО Магнит",
  "ownerInn": "2309085638"
}

status — string enum: EMITTED / APPLIED / INTRODUCED / RETIRED / WRITTEN_OFF / DISAGGREGATION and others.

Each tool additionally returns structuredContent (a typed object according to outputSchema), in addition to the textual JSON.

Examples

Проверь код маркировки 0104600702028445
Расскажи подробнее о товаре с кодом 010460070202844521
Проверь пачку кодов: 0104600702028445, 0104600702028446
Информация о товаре с GTIN 04600702028445
Информация о CIS 0104600702028445

Authorization (True API)

⚠️ Important: True API (ГИС МТ) has no static «eternal» token. The token is obtained using the «request-signature» scheme with an enhanced qualified electronic signature (UKEP) certificate (GOST):

1. GET /api/v3/true-api/auth/key → { uuid, data }

2. Sign data with a UKEP certificate (CAdES-BES, base64).

3. POST /api/v3/true-api/auth/simpleSignIn { uuid, data: <подпись> } → token.

4. Token lifetime — no more than ~10 hours, then re-authorization is required.

This server uses CHESTNYZNAK_TOKEN as a token already obtained in this way (it is sent as Authorization: Bearer). UKEP signing is performed outside the server (e.g., via КриптоПро) — there is no built-in GOST signing here. Registration is available to legal entities/individual entrepreneurs at markirovka.crpt.ru.

The endpoints/methods of the authorized part (paths, request body) were verified against the official documentation and open clients, but have not been tested against a live token due to the UKEP requirement. If ЦРПТ changes the contract — adjust via CHESTNYZNAK_BASE_URL.

Skills

Troubleshooting

API

• Public (no authorization): GET https://mobile.api.crpt.ru/mobile/check?code=<код>&codeType=<тип> — undocumented endpoint of the mobile application.

• Authorized (Bearer): https://markirovka.crpt.ru/api/v3/true-api/... — True API (ГИС МТ).

Development

npm ci
npm run typecheck   # tsc --noEmit (src + tests)
npm test            # vitest
npm run build       # tsc -> dist/
npm run dev         # tsx watch (stdio)
npm run dev:http    # tsx watch (HTTP)

License

MIT