Skip to main content
Glama
tonyyang0504

platform-mcp-hub

by tonyyang0504

platform-mcp

MCP servers for the platform APIs behind real business work: job boards, freelance marketplaces, ad networks, e-commerce channels and suppliers, messaging, social networks, sales data, trading venues, market data and car listings. One evidence-only catalog (catalog/) describes each platform; one package, platform-mcp-hub, serves any of them: platform-mcp-hub serve <id>. The Python package (PyPI) and the TypeScript package (npm) ship the same runtime contract, the whole catalog and the same CLI.

Not published yet. platform-mcp-hub is not on PyPI or npm yet (catalog/schema/release.json says "published": false). Until it is, run it from source as shown below; do not install the name from a registry (anyone could register it first). The operator's steps are in docs/RELEASE_CHECKLIST.md.

Quick start

Once published:

uvx platform-mcp-hub list                    # every served platform (455), with its tools
uvx platform-mcp-hub describe reed           # tools, credentials (PLATFORM_MCP_REED_*), run commands
PLATFORM_MCP_REED_API_KEY=... uvx platform-mcp-hub serve reed            # stdio MCP server
uvx platform-mcp-hub serve reed --http --port 8000                      # Streamable HTTP on 127.0.0.1:8000/mcp
claude mcp add reed -e PLATFORM_MCP_REED_API_KEY=... -- uvx platform-mcp-hub serve reed
npx platform-mcp-hub serve reed              # the TypeScript build: identical tools
uvx platform-mcp-hub directory               # one server that searches the whole catalog (3,500 platforms)

Today, from source:

uvx --from git+https://github.com/tonyyang0504/platform-mcp platform-mcp-hub serve reed
# or in a checkout
git clone https://github.com/tonyyang0504/platform-mcp && cd platform-mcp
uv run platform-mcp-hub serve reed
cd runtime/typescript && npm ci --ignore-scripts && npm run build && node dist/cli.js serve reed

An id served in two categories needs the category: platform-mcp-hub serve social/linkedin. An entry you wrote yourself runs the same way: platform-mcp-hub serve --entry my_entry.json, including a generic entry whose tools come straight from an API's own operations (no category vocabulary; see docs/ADAPTER_CONTRACT.md).

Related MCP server: 0nMCP

Principles

  • Evidence only. Every tool maps to an endpoint documented on the platform's own developer pages, with the docs URL and the date it was verified. Nothing is guessed from a sibling API.

  • One verb vocabulary per category. All job boards expose the same search, get_posting, apply, list_messages; all freelance marketplaces the same search_postings, submit_bid, list_messages, and so on.

  • Honest capabilities. A verb a platform does not offer is not a tool (not_offered says why). Operations a platform's terms forbid are never automated.

  • Standard-first. Current MCP revision, JSON Schema 2020-12 in and out, tool annotations on every tool, API failures as isError results, client-side rate limits, credentials from the environment, no token passthrough.

  • Same behaviour in both languages. The Python and TypeScript runtimes pass the same contract tests; the parity test compares the tools of every served entry and the CLI answers of both builds.

Layout

catalog/               the source of truth: <category>/<platform>.json, schema/vocab.json, index and directory snapshot
runtime/python/        platform_mcp_hub: runtime, CLI, directory server, lint, try/smoke/live-verify tools
runtime/typescript/    the npm package: runtime, CLI and directory server (same contract)
generators/python/     registry metadata per served entry (servers/<category>/<id>/server.json, manifest.json, README)
servers/               generated registry metadata (no code: every server is `platform-mcp-hub serve <id>`)
tools/                 gen_all (regenerate everything derived), build_directory, auth_audit, smoke_stdio
tests/                 contract tests per platform (both languages), runtime, security and CLI parity tests
docs/                  adapter contract, architecture, live verification and auth audit reports, security review

Credentials and security

Credentials come only from PLATFORM_MCP_<ID>_<FIELD> environment variables (describe lists them); vendor sandboxes are selected with PLATFORM_MCP_<ID>_ENV. Outbound requests are refused for private, loopback and metadata addresses (connections are pinned to the vetted address), secrets are redacted from every message, catalog text is sanitised before an MCP client sees it, and --http binds 127.0.0.1 unless you pass --allow-remote and set PLATFORM_MCP_HTTP_TOKEN. See SECURITY.md and docs/SECURITY_REVIEW_2026-10.md.

Limits (honest list)

  • Coverage. 455 of about 3,500 catalogued platforms are served. The others carry a status record (gated or partner-only docs, upload-only access, an official vendor MCP server, or auth the runtime does not support yet).

  • Verification depth. Keyless servers are live-verified (docs/LIVE_VERIFICATION.md, each entry's live_check). Servers that need credentials passed a credential-free audit (docs/AUTH_AUDIT.md): endpoints and specs were checked, but most have not been exercised with a real account. Write tools were never called live.

  • APIs change. Entries cite the docs as they were on verified_at; vendors move endpoints and limits.

  • Terms are yours to respect. Using a server means using the platform's API under its terms with your credentials. The catalog notes known restrictions; it is not legal advice.

  • Unpublished. Until the release, installs are from source and registry metadata (servers/) is not live.

  • TypeScript CLI serves (list, describe, serve, directory); the authoring tools (lint, try, smoke, verify) are in the Python package.

The documentation-to-entry authoring tools that used to live here (the "forge") are now a separate project, api-to-mcp, which uses platform-mcp-hub as its runtime.

Contributing

Pull requests are welcome: a new platform, a fix to an entry, runtime work. Read CONTRIBUTING.md (gates, DCO sign-off) and docs/ADAPTER_CONTRACT.md. Security issues: SECURITY.md. Changes: CHANGELOG.md.

Licence

Apache-2.0. See LICENSE and NOTICE.

Available Tools

3 tools
get_postingGet a job postingA
Read-onlyIdempotent

Fetch one posting by the id returned from search.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
idYes
rawNo
urlNo
titleYes
companyNo
currencyNo
locationNo
posted_atNo
salary_maxNo
salary_minNo
descriptionNo

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent, non-destructive and openWorld, so the safety profile is covered. The description adds only the provenance of the id value, not return format, error behavior, or missing-id handling.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single tight sentence with the key constraint (one posting, by id from search) front-loaded and zero filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be explained. For a one-param lookup with full annotations, the description covers what an agent needs, though a note on missing ids or errors would complete it.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The single parameter has 0% schema description coverage, so the description must carry the meaning. "id returned from search" usefully tells the agent where the id originates, but gives no format or validation details.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (Fetch) and resource (one posting) with a clear singular scope. It implicitly distinguishes itself from the search sibling by noting the id comes from search, but never names the alternative explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

"the id returned from search" implies this is a follow-up call to search, which is useful sequencing context. However, there is no explicit when-to-use/when-not guidance or named alternative to route the agent.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

meWho am IA
Read-onlyIdempotent

Verify the credentials and describe the connected account. Verified with a one-result search (Reed has no account endpoint).

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
okYes
accountNo

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, openWorldHint, and destructiveHint=false. The description adds useful context beyond those annotations: it explains that verification is performed via a one-result search because 'Reed has no account endpoint.' That is genuine behavioral disclosure about the underlying mechanism.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with the purpose. The implementation note is parenthetical and brief. No wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With a rich output schema and full annotations, the description need not explain return values or safety. It covers purpose and the underlying verification approach. The main gap is the absence of usage guidelines relative to sibling tools.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so the baseline is 4. Schema description coverage is 100%, and there are no parameters to document further.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a clear verb and resource: 'Verify the credentials and describe the connected account.' This is specific enough for an agent to know it's an identity/account check, distinct from get_posting and search, though it does not explicitly name or contrast those siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'Verify the credentials' implies a use case, but there is no explicit when-to-use guidance, no when-not-to-use conditions, and no mention of alternatives like search or get_posting. Usage is only implied.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 3 tool updatesv0.1.0
    • First observedget_posting
    • First observedme
    • First observedsearch

TDQS

B3.4/5.0

Scored across 3 tools

Disambiguation5/5

The three tools have clearly distinct purposes: 'me' verifies account credentials, 'search' discovers job postings, and 'get_posting' retrieves a specific posting by ID. There is no overlap or ambiguity between them.

Naming Consistency3/5

Names mix styles: 'me' is a noun/pronoun endpoint, 'search' is a bare verb, and 'get_posting' uses a verb_noun pattern. Still readable, but it does not follow a single predictable convention.

Tool Count4/5

Three tools is a lean but adequate surface for a read-only job posting integration. It covers discovery, retrieval, and auth; a pagination or facets helper could be useful but is not essential.

Completeness4/5

The core read-only workflow is complete: authenticate/verify, search postings, and fetch a posting by ID. No create/update/delete is expected for a third-party platform, though ancillary operations like listing companies or saved searches are absent.

Related MCP Connectors

Related MCP Servers

  • A
    license
    A
    quality
    B
    maintenance
    The API layer for AI agents. World's biggest API index with 22,000+ APIs and growing. Agents discover and call APIs at runtime with semantic search, structured metadata, and 18 Direct Call APIs including AI providers.
    14
    349 npm
    8
    MIT
  • F
    license
    Not graded
    quality
    Not graded
    maintenance
    Universal AI API Orchestrator. 850 tools across 53 services under a single MCP interface. Connect Claude, GPT, or Gemini to Stripe, Slack, GitHub, LinkedIn, Cloudflare, Shopify, Twilio, and 46 more via natural language. $0.10/execution, no subscription. Patent Pending.
    149 npm
    5
    -
  • A
    license
    Not graded
    quality
    D
    maintenance
    Connects AI assistants to over 30 business tools like Gmail, Slack, and Airtable through a single unified interface. It enables users to perform actions across multiple platforms using natural language without managing individual API integrations.
    24 npm
    MIT