https://produproduce.mysite.com/ustorebackofficerestapi의 XMPie uStore BackOffice REST API용 MCP 서버입니다.
상태: 작동 중, 라이브 API에 대해 종단 간 검증 완료. 스펙 로드(15개 태그 그룹에 걸쳐 52개 경로 / 63개 작업), 로그인 성공, ustore_call_endpoint GET /v1/admin/stores가 HTTP 200을 반환합니다. 읽기 전용 가드는 DELETE를 올바르게 거부합니다.
서버는 엔드포인트를 하드코딩하지 않습니다. 최초 사용 시 API 자체의 OpenAPI 3.0 문서를 가져와 그 위에 다 가지 도구를 노출합니다:
도구 | 용도 |
| 컨트롤러 그룹 + 작업 수 — 방향 확인 호출 |
| 태그, 메서드 또는 텍스트로 작업 검색/필터링 |
| 전체 계약: 매개변수, 요청 본문, 응답 형태 |
| 요청 실행; 인증은 서버 측에서 처리 |
| 진단: 기본 URL, 스펙 소스, 인증 모드, 쓰기 정책 |
이는 MSSQL MCP 서버(list_databases → list_tables → describe_table → query)와 같은 형태이며, API가 노출하는 엔드포인트 수에 관계없이 도구 수를 적게 유지합니다. 또한 uStore 업그레이드에도 대응합니다. 새 엔드포인트는 다음 스펙 새로고침 때 자동으로 나타납니다.
쓰기는 기본적으로 비활성화되어 있습니다. 서버 프로세스에 USTORE_ALLOW_WRITES=true가 설정될 때까지 GET이 아닌 메서드는 거부됩니다.
Related MCP server: mcp-db-server
produproduce에 내부 네트워크로 접근할 수 있는 호스트에서 실행해야 합니다.
cd /opt/mcp/ustore-backoffice-mcp
npm install
cp .env.example .env
$EDITOR .env # credentials — the base URL and spec URL are preset
npm run probe # optional: re-confirm the spec URL and auth handshake인증 핸드셰이크는 라이브 API에 대해 확인되었으며 이미 기본값입니다:
POST {base}/v1/admin/auth/login {"email": "...", "password": "..."}
-> 200 {"Token": "..."}
Authorization: uStoreBackoffice <token> # on every subsequent request로그인 본문은 username이 아니라 email을 사용하며, 토큰 필드는 대문자 Token입니다. 스킴은 말 그대로 uStoreBackoffice입니다. API는 다른 접두어를 {"Errors":[{"Message":"Invalid security token."}]}로 거부합니다.
스펙 URL도 마찬가지로 확인되어 사전 설정되어 있습니다:
USTORE_SPEC_URL=https://produproduce.mysite.com/ustorebackofficerestapi/ustore-oas3명시적으로 설정해야 합니다. 이 배포는 /ustore-oas3에서 OAS3를 제공하며, 그렇지 않으면 loadSpec()이 탐색할 경로가 모두 404를 반환합니다.
그런 다음:
npm run http # or: npm run stdio확인:
$ curl -s localhost:8931/healthz
{"ok":true,"target":"https://produproduce.mysite.com/ustorebackofficerestapi"}/healthz는 프로세스가 실행 중이라는 것만 증명합니다. API 구간이 작동하는지 확인하려면 클라이언트에서 ustore_server_info를 호출하세요. 해석된 인증 스킴과 작업 수를 보고하며, 로그인이 깨져 있으면 크게 실패합니다.
pm2 start index.js --name ustore-mcp --node-args="--enable-source-maps"
pm2 save[Unit]
Description=uStore BackOffice MCP server
After=network-online.target
[Service]
Type=simple
User=tc
WorkingDirectory=/opt/mcp/ustore-backoffice-mcp
EnvironmentFile=/opt/mcp/ustore-backoffice-mcp/.env
ExecStart=/usr/bin/node index.js
Restart=on-failure
RestartSec=5
[Install]
WantedBy=multi-user.target.env는 chmod 600으로 유지하세요. 관리자 자격 증명인 uStore BackOffice 자격 증명이 들어 있습니다.
SSE는 버퍼링을 끄고 긴 서버 타임아웃이 필요합니다. 그렇지 않으면 세션이 끊깁니다:
backend be_mcp_ustore
mode http
option http-server-close
timeout server 3600s
timeout tunnel 3600s
http-request set-header X-Accel-Buffering no
server ustore1 127.0.0.1:8931 check두 전송 방식 모두 제공됩니다: POST /mcp(Streamable HTTP, 현재 스펙) 및 GET /sse + POST /messages(레거시 SSE, 기존 스택과 일치). HAProxy ACL만 사용하지 않고 서버 자체가 공유 비밀을 확인하도록 하려면 MCP_BEARER_TOKEN을 설정하세요.
로컬 stdio(같은 머신의 Claude Desktop):
{
"mcpServers": {
"ustore-backoffice": {
"command": "node",
"args": ["/opt/mcp/ustore-backoffice-mcp/index.js"],
"env": { "MCP_TRANSPORT": "stdio" }
}
}
}구성 파일을 BOM 없이 UTF-8로 작성하세요.
해당 env 블록에는 자격 증명이 필요 없습니다. 서버는 index.js 옆에 있는 .env를 읽습니다. Claude Desktop은 cwd=/와 거의 빈 환경으로 MCP 서버를 실행하므로, config.js는 작업 디렉터리가 아닌 자신의 파일 위치를 기준으로 .env를 해석합니다. env에 넣은 것은 여전히 우선합니다. 실제 환경 변수가 파일보다 우선합니다.
구성을 편집한 후 Claude Desktop을 완전히 종료하세요(macOS에서 Cmd-Q, 창을 닫는 것만으로는 안 됩니다). 그래야 서버 프로세스가 다시 시작됩니다.
자격 증명 범위. BackOffice API 계정은 일반적으로 전체 관리자입니다. uStore에서 제한된 운영자 역할을 지원한다면 그 역할을 사용하세요. 이 서버의 읽기 전용 가드는 사고를 방지하는 것이지, 유출된 토큰을 방지하는 것이 아닙니다.
**USTORE_ALLOW_PATHS**는 정규식 허용 목록입니다. 이를 설정하면 서버가 실제로 필요한 컨트롤러로 좁혀지며, 이는 쓰기 플래그만으로보다 더 강력한 제어입니다.
응답 잘림은 기본적으로 60,000자입니다. 목록 엔드포인트가 넘칠 경우 상한을 높이는 대신 페이지 매김 매개변수를 사용하세요. 이 API는 pageNumber(1부터 시작)와 pageSize(기본 50)로 표기합니다.
스펙 캐싱은 15분마다 새로고침됩니다. uStore 업그레이드 후에는 refreshSpec: true와 함께 ustore_server_info를 호출하여 변경 사항을 즉시 반영하세요.
연결 실패처럼 보이는 인증 실패. 서버는 자격 증명이 없어도 시작되고 도구를 나열합니다. 로그인은 첫 API 호출 때만 발생합니다. 도구가 표시되지만 모든 호출이 오류를 반환하면 ustore_server_info를 실행하고 hasToken을 확인하세요.
SQL MCP 서버를 대체하는 것이 아니라 보완합니다. REST API는 uStore의 비즈니스 로직을 적용하므로 상태를 변경하는 모든 작업에 올바른 경로입니다. 직접 [PRODUPRODUCE].ustore 쿼리는 보고용 조인과 스키마 분석에 여전히 더 적합합니다.
Execute a request against the uStore BackOffice REST API. Path placeholders such as {orderId} are filled from pathParams. Authentication is handled by the server. Non-GET methods are refused unless writes are explicitly enabled.
| Name | Required | Description | Default |
|---|---|---|---|
| body | No | JSON request body for POST/PUT/PATCH | |
| path | Yes | Spec path, e.g. /api/Orders/{orderId} | |
| query | No | Query string parameters | |
| method | Yes | GET, POST, PUT, DELETE, PATCH | |
| headers | No | Extra request headers | |
| pathParams | No | Values substituted into {placeholders} |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Without annotations, the description carries the burden, and it does add useful behavioral context: authentication is server-side, and non-GET methods are refused unless writes are explicitly enabled. However, it does not clarify what 'explicitly enabled' means, nor does it describe errors, response behavior, or side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four short sentences deliver the essential facts without filler. The most critical constraints and behaviors are placed up front, and every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description is adequate for a generic endpoint caller, covering auth, path substitution, and write protection. However, the ambiguous 'writes explicitly enabled' condition and the lack of any guidance about the response format or failure modes leave meaningful gaps for an agent choosing to invoke likely mutating endpoints.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is complete, but the description adds meaningful context beyond the schema by explaining how pathParams fill placeholders and by adding an operational constraint on the method parameter. This behavior cannot be inferred from the input schema alone.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific action ('Execute a request against the uStore BackOffice REST API') and clearly identifies the target resource and mechanism. It distinguishes the tool from siblings like list_endpoints or describe_endpoint by being the actual invocation tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The intended use—executing a request—is implied by the name and description, but there is no explicit guidance about when to choose this against discovering or describing endpoints. The write-refusal note is a restriction, not a usage guideline with alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Show the full contract for one operation: path/query/header parameters, request body shape, and response shape. Call this before ustore_call_endpoint.
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | e.g. /api/Orders/{orderId} | |
| method | No | Required when path is ambiguous | |
| operationId | No | Alternative to path+method |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description implies a read-only operation (showing the contract) but does not explicitly state that it has no side effects or require permissions. It does add useful behavioral context by explaining what the tool returns and the required sequence, but lacks mention of error behavior or edge cases.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences that front-load the core purpose and then give actionable guidance. No filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers what the tool returns and its recommended usage sequence. Missing mention of error behaviors or parameter ambiguity resolution, but given its simple role and lack of output schema, it is sufficiently complete for an agent to invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already provides descriptions for all three parameters with 100% coverageging. The description mentions the contract contents but doesn't add further semantic meaning to the parameters themselves, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Show the full contract for one operation' and enumerates the contract's contents (path/query/header parameters, request body, response shape). It distinguishes this from sibling tools by tying it to ustore_call_endpoint, making its purpose unambiguous and specific.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly directs the agent to 'Call this before ustore_call_endpoint', providing a clear temporal use case. It doesn't discuss when not to use it or contrast with list_endpoints, but the core guidance is strong and actionable.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
List operations in the uStore BackOffice REST API. Filter by tag, HTTP method, or a free-text search across path, operationId and summary.
| Name | Required | Description | Default |
|---|---|---|---|
| tag | No | Restrict to one tag group | |
| limit | No | Default 100 | |
| method | No | GET, POST, PUT, DELETE, PATCH | |
| search | No | Substring match on path/operationId/summary |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden of indicating safety and behavior. 'List operations' conveys a read-only action and the filterable fields are stated, but it does not describe pagination behavior, output shape, or authentication expectations. This is acceptable for a simple list tool but not highly transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two short sentences with the key action first and filtering capabilities in the second. Every word earns its place; there is no repetition or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple discovery tool with four fully documented optional parameters and no output schema, the description is largely complete: it states the resource, the filtering dimensions, and implies the fields available in results. It does not add alternative-tool guidance, but given the low complexity, this is a minor gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description rephrases tag, method, and search filtering but adds little beyond the schema's parameter descriptions; the search field details are already present in the schema. The limit parameter is left entirely to the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool lists operations in the uStore BackOffice REST API, with a specific verb and resource. It distinguishes itself from siblings like ustore_describe_endpoint, ustore_call_endpoint, and ustore_list_tags by focusing on discovering operations rather than describing, calling, or listing tags.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The intended use is implied by the purpose — discover API operations and optionally filter them — but the description does not explicitly state when to prefer this tool over alternatives, nor does it mention excluded cases or prerequisites. There is no when/when-not guidance, only the clear listing behavior.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
List the tag groups (controllers) exposed by the uStore BackOffice REST API, with the number of operations in each. Start here to orient yourself.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It clearly identifies the operation as a read-only listing ('List') and specifies what is returned (tag groups with operation counts). It does not mention auth or rate limits, but for a simple zero-parameter list this is not a significant gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the action and resource, and every sentence earns its place. 'Start here to orient yourself' adds practical guidance without unnecessary verbosity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter orientation tool with no output schema, the description is sufficiently complete: it states what is listed, what counts are included, and how to use it as a starting point. It could mention relationship to sibling tools, but this is not essential for the tool's simple purpose.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters and schema description coverage is 100%, so the baseline is 4. The description does not need to add parameter details, and it appropriately focuses on the output and purpose.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('List') with a clear resource ('tag groups (controllers) exposed by the uStore BackOffice REST API') and adds useful detail ('with the number of operations in each'). It distinguishes itself from sibling tools like list_endpoints and describe_endpoint by focusing specifically on tag groups/controllers.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'Start here to orient yourself' provides clear context for when to use this tool, positioning it as the initial discovery step. However, it does not explicitly name alternatives or state when not to use it, so it falls short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Report the configured base URL, spec source, auth mode, and write policy. Use this when calls are failing to confirm how the server is wired up.
| Name | Required | Description | Default |
|---|---|---|---|
| refreshSpec | No | Re-fetch the OpenAPI document |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations, but description implies a read-only reporting operation. The parameter description covers refreshSpec's side effect (re-fetching OpenAPI), providing adequate transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences: first states purpose, second gives usage context. No redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple info tool with one optional parameter and no output schema, the description covers what it does and when to use it, making it complete enough.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Parameter refreshSpec is fully described in the schema (coverage 100%). The main description adds no extra meaning beyond the schema, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states it reports the configured base URL, spec source, auth mode, and write policy, distinguishing from sibling tools like list/describe/call endpoints.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly suggests using when calls are failing to confirm server wiring, but does not mention when not to use or alternatives (though siblings are evident).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
v1.0.1ustore_call_endpointustore_describe_endpointustore_list_endpointsustore_list_tagsustore_server_infoScored across 5 tools
Each tool has a distinct role: listing tags, listing endpoints, describing a single endpoint, calling an endpoint, and reporting server info. No overlap or ambiguity between them.
Most tools follow a ustore_verb_noun pattern (list_tags, list_endpoints, describe_endpoint, call_endpoint), but server_info deviates by using noun_noun without a verb. This is a minor inconsistency in an otherwise predictable scheme.
Five tools is an ideal count for a focused API client server. Each tool serves a necessary and distinct function, with no bloat or obvious missing piece.
The tool set covers the full workflow: orient (list tags), discover (list endpoints), understand (describe endpoint), and act (call endpoint), plus diagnostics (server info). No critical gaps for interacting with the underlying API.
Ask your Quickbase apps in plain language. Read-only by default; writes need human approval.
Query your org's data in natural language — read-only MCP access to SQL, NoSQL, files & warehouses.
Read-only AgentiScript concept search, catalog, authenticity, license, and approved asset discovery.
Query and audit AppSheet apps in natural language via Knotrik's pre-scanned definitions.
