kiwoom-mcp-server 0.16.0 → 0.17.0

package/README.en.md

@@ -123,6 +123,11 @@ npm test                     # unit tests (no network required)
 | `ISA_ENABLED` | | `true` registers the `calc_isa_tax_status` tool. Default `false` (general-account-first) |
 | `ISA_TYPE` | | `GENERAL` (general, 2,000,000 KRW limit, default) or `SEOMIN` (low-income/farmer-fisher, 4,000,000 KRW). Only used when `ISA_ENABLED=true` |
 | `ISA_OPENED_ON` | | ISA account opening date `yyyy-MM-dd` — default aggregation start for `calc_isa_tax_status`. Only used when `ISA_ENABLED=true` |
+| `MCP_TRANSPORT` | | `stdio` (default) or `http` — see [Remote access](#remote-access-http-mode--claudeai-webmobile) |
+| `MCP_AUTH_TOKEN` | HTTP mode ✅ | Bearer token every `/mcp` request must present in HTTP mode |
+| `MCP_HTTP_PORT` | | HTTP-mode port (default `8000`) |
+| `MCP_HTTP_HOST` | | HTTP-mode bind address (default `127.0.0.1`) |
+| `MCP_HTTP_NO_AUTH` | | `true` allows starting HTTP mode without auth (discouraged — see the security notes below) |
 
 The default is **general-account-first**: without extra config, only the market-data
 and account-inquiry tools are exposed. To use the tax-free-limit tool on an ISA
@@ -195,6 +200,38 @@ From source — app key from the project-root `.env`:
 claude mcp add kiwoom -- node /absolute/path/kiwoom-mcp-server/dist/index.js
 ```
 
+## Remote access (HTTP mode) — claude.ai web/mobile
+
+claude.ai **custom connectors** (web/mobile) cannot attach to a local stdio server;
+they need a **Streamable HTTP** MCP server reachable over public HTTPS. Start this
+server in HTTP mode with the `--http` flag (or `MCP_TRANSPORT=http`):
+
+```sh
+MCP_AUTH_TOKEN="$(openssl rand -hex 32)" npx -y kiwoom-mcp-server --http --port 8000
+# endpoint: http://127.0.0.1:8000/mcp · health check: /healthz
+```
+
+- **Auth is required by default.** Without `MCP_AUTH_TOKEN` the server refuses to
+  start — every `/mcp` request must carry `Authorization: Bearer <token>`. To run
+  without auth you must pass `--no-auth` explicitly; the account-inquiry tools are
+  then exposed as-is, so do that only on a trusted network or with a paper-trading
+  key (`KIWOOM_MODE=VIRTUAL`).
+- The default bind is `127.0.0.1`, assuming a tunnel in front. To expose directly
+  (container/VPS), opt in with `--host 0.0.0.0`.
+- Get a public HTTPS URL with e.g. [Cloudflare Tunnel](https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/):
+  `cloudflared tunnel --url http://localhost:8000` (ephemeral URL — use a named
+  tunnel for anything permanent).
+- Register on claude.ai under **Settings → Connectors → Add custom connector** with
+  `https://<your-domain>/mcp`. The bearer token can be supplied via the connector's
+  request-header settings (beta). A connector added once is available across the
+  web, mobile, and desktop clients.
+- ⚠️ **Kiwoom API calls originate from wherever this server runs.** REAL mode is
+  bound to Kiwoom's designated-terminal (8050) IP registration, so running it
+  outside a registered IP (e.g. in the cloud) can fail auth. Validate remote
+  setups with a VIRTUAL key first.
+
+The stdio behavior (Claude Desktop/Code) is unchanged when run without arguments.
+
 ## Smoke test
 
 You can verify over stdio without an MCP client:

package/README.md

@@ -115,6 +115,11 @@ npm test                    # 단위 테스트 (네트워크 불필요)
 | `ISA_ENABLED` | | `true`면 `calc_isa_tax_status` tool 활성화. 기본값 `false`(일반 계좌 기준) |
 | `ISA_TYPE` | | `GENERAL`(일반형, 한도 200만원, 기본값) 또는 `SEOMIN`(서민형/농어민형, 400만원). `ISA_ENABLED=true`일 때만 사용 |
 | `ISA_OPENED_ON` | | ISA 계좌 개설일 `yyyy-MM-dd` — `calc_isa_tax_status` 집계 시작일 기본값. `ISA_ENABLED=true`일 때만 사용 |
+| `MCP_TRANSPORT` | | `stdio`(기본값) 또는 `http` — [원격 연결](#원격-연결-http-모드--claudeai-웹모바일) 참조 |
+| `MCP_AUTH_TOKEN` | HTTP 모드 ✅ | HTTP 모드에서 모든 `/mcp` 요청이 제시해야 하는 Bearer 토큰 |
+| `MCP_HTTP_PORT` | | HTTP 모드 포트 (기본값 `8000`) |
+| `MCP_HTTP_HOST` | | HTTP 모드 바인드 주소 (기본값 `127.0.0.1`) |
+| `MCP_HTTP_NO_AUTH` | | `true`면 인증 없이 HTTP 모드 기동 허용 (비권장 — 아래 보안 주의 참조) |
 
 기본값은 **일반(비-ISA) 계좌 기준**입니다 — 별도 설정이 없으면 시장·계좌 조회 tool만
 노출됩니다. ISA 계좌를 연결해 비과세 한도 tool을 쓰려면 `ISA_ENABLED=true`로 켜고
@@ -186,6 +191,34 @@ claude mcp add kiwoom \
 claude mcp add kiwoom -- node /절대/경로/kiwoom-mcp-server/dist/index.js
 ```
 
+## 원격 연결 (HTTP 모드) — claude.ai 웹/모바일
+
+claude.ai(웹/모바일)의 **커스텀 커넥터**는 로컬 stdio 서버에 직접 붙을 수 없고, 공개
+HTTPS로 접근 가능한 **Streamable HTTP** MCP 서버가 필요합니다. `--http` 플래그(또는
+`MCP_TRANSPORT=http`)로 이 서버를 HTTP 모드로 띄울 수 있습니다:
+
+```sh
+MCP_AUTH_TOKEN="$(openssl rand -hex 32)" npx -y kiwoom-mcp-server --http --port 8000
+# 엔드포인트: http://127.0.0.1:8000/mcp · 헬스체크: /healthz
+```
+
+- **인증이 기본 필수입니다.** `MCP_AUTH_TOKEN`이 없으면 기동을 거부합니다 — 모든 `/mcp`
+  요청에 `Authorization: Bearer <토큰>` 헤더가 있어야 합니다. 인증 없이 열려면
+  `--no-auth`를 명시해야 하며, 계좌 조회 도구가 그대로 노출되므로 신뢰할 수 있는
+  네트워크나 모의투자(`KIWOOM_MODE=VIRTUAL`)에서만 사용하세요.
+- 기본 바인드는 `127.0.0.1`입니다 — 터널을 앞에 두는 구성을 전제합니다. 컨테이너/서버에
+  직접 노출하려면 `--host 0.0.0.0`을 명시하세요.
+- 공개 HTTPS URL은 [Cloudflare Tunnel](https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/) 등으로 만듭니다:
+  `cloudflared tunnel --url http://localhost:8000` (임시 URL — 상시 운영은 named tunnel 권장).
+- claude.ai 등록: **Settings → Connectors → Add custom connector**에
+  `https://<도메인>/mcp`를 입력합니다. Bearer 토큰은 Advanced settings의 요청 헤더
+  설정(베타)으로 전달할 수 있습니다. 등록한 커넥터는 웹/모바일/데스크톱에서 공용입니다.
+- ⚠️ **키움 API 호출은 이 서버가 실행되는 곳에서 나갑니다.** REAL 모드는 키움 지정단말기
+  인증(8050)이 IP에 묶이므로, 등록된 IP가 아닌 곳(클라우드 등)에서 실행하면 인증 오류가
+  날 수 있습니다. 원격 노출은 모의투자로 먼저 검증하세요.
+
+기존 stdio 동작(Claude Desktop/Code 연결)은 인자 없이 실행하면 그대로입니다.
+
 ## 동작 확인
 
 MCP 클라이언트 없이 stdio로 직접 확인할 수 있습니다:

package/dist/config.js

@@ -41,7 +41,7 @@ const MODE_LABELS = {
     REAL: "실전투자",
 };
 let cached = null;
-function loadDotEnv() {
+export function loadDotEnv() {
     // Claude Desktop launches this server with an arbitrary cwd, so resolve .env
     // relative to the project root (parent of dist/ or src/) first.
     const projectRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");

package/dist/http.js

@@ -0,0 +1,135 @@
+import { createHash, timingSafeEqual } from "node:crypto";
+import http from "node:http";
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import { createServer, SERVER_NAME, SERVER_VERSION } from "./server.js";
+const DEFAULT_PORT = 8000;
+const DEFAULT_HOST = "127.0.0.1";
+const MCP_PATH = "/mcp";
+const HEALTH_PATH = "/healthz";
+/**
+ * Decides the transport from CLI args + env. Pure (unit-testable): pass
+ * process.argv.slice(2) and process.env. Defaults to stdio so existing
+ * Claude Desktop/Code installs are untouched; HTTP is strictly opt-in.
+ *
+ * The auth token is env-only (MCP_AUTH_TOKEN) — a CLI flag would leak the
+ * secret to `ps`. HTTP mode refuses to start without a token unless the
+ * operator explicitly passes --no-auth: this server fronts a brokerage
+ * account, so an unauthenticated public endpoint must be a deliberate act.
+ */
+export function chooseTransport(argv, env) {
+    const flags = new Set();
+    const values = new Map();
+    for (let i = 0; i < argv.length; i += 1) {
+        const arg = argv[i];
+        if (arg === "--port" || arg === "--host") {
+            const value = argv[i + 1];
+            if (value === undefined || value.startsWith("--")) {
+                throw new Error(`${arg} 옵션에 값이 없습니다 (예: ${arg === "--port" ? "--port 8000" : "--host 127.0.0.1"}).`);
+            }
+            values.set(arg, value);
+            i += 1;
+        }
+        else if (arg === "--http" || arg === "--stdio" || arg === "--no-auth") {
+            flags.add(arg);
+        }
+        else {
+            throw new Error(`알 수 없는 옵션입니다: ${arg} (지원: --http, --stdio, --port <n>, --host <addr>, --no-auth)`);
+        }
+    }
+    const envTransport = env.MCP_TRANSPORT?.trim().toLowerCase();
+    if (envTransport !== undefined && envTransport !== "" && envTransport !== "stdio" && envTransport !== "http") {
+        throw new Error(`MCP_TRANSPORT 값이 잘못되었습니다: "${env.MCP_TRANSPORT}" (stdio 또는 http).`);
+    }
+    const wantsHttp = flags.has("--http") || (!flags.has("--stdio") && envTransport === "http");
+    if (!wantsHttp)
+        return { mode: "stdio" };
+    const portRaw = values.get("--port") ?? env.MCP_HTTP_PORT?.trim();
+    let port = DEFAULT_PORT;
+    if (portRaw !== undefined && portRaw !== "") {
+        port = Number(portRaw);
+        if (!Number.isInteger(port) || port < 0 || port > 65535) {
+            throw new Error(`포트가 잘못되었습니다: "${portRaw}" (0~65535 정수).`);
+        }
+    }
+    const host = values.get("--host") ?? (env.MCP_HTTP_HOST?.trim() || DEFAULT_HOST);
+    const allowNoAuth = flags.has("--no-auth") || env.MCP_HTTP_NO_AUTH?.trim().toLowerCase() === "true";
+    const authToken = env.MCP_AUTH_TOKEN?.trim() || undefined;
+    if (!authToken && !allowNoAuth) {
+        throw new Error("HTTP 모드에는 MCP_AUTH_TOKEN 환경변수가 필요합니다 (모든 /mcp 요청의 Bearer 토큰). " +
+            "인증 없이 열려면 --no-auth를 명시하세요 — 계좌 조회 도구가 인터넷에 그대로 노출되므로 " +
+            "신뢰할 수 있는 네트워크/모의투자(VIRTUAL) 환경에서만 권장합니다.");
+    }
+    return { mode: "http", options: { port, host, authToken, allowNoAuth } };
+}
+/** Timing-safe bearer-token check (hash first so lengths never short-circuit). */
+export function isAuthorized(authorizationHeader, token) {
+    if (!authorizationHeader)
+        return false;
+    const match = /^Bearer\s+(.+)$/i.exec(authorizationHeader.trim());
+    if (!match)
+        return false;
+    const presented = createHash("sha256").update(match[1]).digest();
+    const expected = createHash("sha256").update(token).digest();
+    return timingSafeEqual(presented, expected);
+}
+function deny(res, status, message) {
+    res.writeHead(status, { "Content-Type": "application/json" }).end(JSON.stringify({
+        jsonrpc: "2.0",
+        error: { code: -32000, message },
+        id: null,
+    }));
+}
+/**
+ * Streamable HTTP endpoint for remote MCP clients (claude.ai custom
+ * connectors, Claude Desktop/mobile via the account-brokered connector).
+ * Stateless per the MCP spec: each request gets a fresh McpServer+transport
+ * pair; the expensive state (Kiwoom token cache, ka10099 master-list cache)
+ * lives at module level and is shared across requests.
+ */
+export function createHttpServer(options) {
+    return http.createServer((req, res) => {
+        void handleRequest(req, res, options).catch((error) => {
+            console.error("HTTP request handling failed:", error);
+            if (!res.headersSent)
+                deny(res, 500, "internal server error");
+        });
+    });
+}
+async function handleRequest(req, res, options) {
+    const url = new URL(req.url ?? "/", `http://${req.headers.host ?? "localhost"}`);
+    if (url.pathname === HEALTH_PATH) {
+        res.writeHead(200, { "Content-Type": "text/plain" }).end("ok");
+        return;
+    }
+    if (url.pathname !== MCP_PATH) {
+        deny(res, 404, `not found — MCP endpoint is ${MCP_PATH}`);
+        return;
+    }
+    if (options.authToken && !isAuthorized(req.headers.authorization, options.authToken)) {
+        deny(res, 401, "unauthorized — Authorization: Bearer <MCP_AUTH_TOKEN> 헤더가 필요합니다");
+        return;
+    }
+    const server = createServer();
+    const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: undefined });
+    res.on("close", () => {
+        void transport.close();
+        void server.close();
+    });
+    await server.connect(transport);
+    await transport.handleRequest(req, res);
+}
+export async function startHttpServer(options) {
+    const server = createHttpServer(options);
+    await new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(options.port, options.host, resolve);
+    });
+    const address = server.address();
+    const boundPort = typeof address === "object" && address ? address.port : options.port;
+    console.error(`${SERVER_NAME} v${SERVER_VERSION} listening on http://${options.host}:${boundPort}${MCP_PATH} ` +
+        `(auth: ${options.authToken ? "bearer token" : "NONE — --no-auth"})`);
+    if (!options.authToken) {
+        console.error("⚠️  인증 없이 실행 중입니다. 이 서버는 계좌 조회 도구를 노출하므로 공개 네트워크에 직접 연결하지 마세요.");
+    }
+    return server;
+}

package/dist/index.js

@@ -1,7 +1,17 @@
 #!/usr/bin/env node
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { loadDotEnv } from "./config.js";
+import { chooseTransport, startHttpServer } from "./http.js";
 import { createServer, SERVER_NAME, SERVER_VERSION } from "./server.js";
 async function main() {
+    // Load .env before reading MCP_* transport vars (credential validation stays
+    // lazy in getConfig). Real environment variables win over the file.
+    loadDotEnv();
+    const choice = chooseTransport(process.argv.slice(2), process.env);
+    if (choice.mode === "http") {
+        await startHttpServer(choice.options);
+        return;
+    }
     const server = createServer();
     const transport = new StdioServerTransport();
     await server.connect(transport);

package/dist/server.js

@@ -27,7 +27,7 @@ import { registerTransactionsTool } from "./tools/transactions.js";
 import { registerViStocksTool } from "./tools/vi-stocks.js";
 import { registerWatchlistGroupsTool, registerWatchlistTool } from "./tools/watchlist.js";
 export const SERVER_NAME = "kiwoom-mcp-server";
-export const SERVER_VERSION = "0.16.0";
+export const SERVER_VERSION = "0.17.0";
 export function createServer() {
     const server = new McpServer({
         name: SERVER_NAME,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kiwoom-mcp-server",
-  "version": "0.16.0",
+  "version": "0.17.0",
   "description": "Read-only MCP server exposing the Kiwoom Securities REST API (market data, account inquiry, ISA tax-allowance calculator) to Claude Desktop / Claude Code.",
   "private": false,
   "type": "module",