@iimmpact-sdn-bhd/mcp

Local stdio-to-HTTP bridge for the IIMMPACT MCP endpoint. It signs each exact JSON-RPC line locally with the API's HMAC v1 scheme, allowing a standard stdio MCP host to use the stateless remote endpoint without sending the HMAC secret anywhere except in request signatures.

Configure your MCP host

Run the published signer through your MCP host with credentials supplied through its environment. Never pass credentials as command-line arguments:

{
  "mcpServers": {
    "iimmpact": {
      "command": "npx",
      "args": ["-y", "@iimmpact-sdn-bhd/mcp@latest"],
      "env": {
        "IIMMPACT_API_KEY": "your-api-key",
        "IIMMPACT_HMAC_SECRET": "your-base64-encoded-hmac-secret",
        "IIMMPACT_MCP_URL": "https://api.iimmpact.com/mcp",
        "IIMMPACT_MCP_TIMEOUT_MS": "120000"
      }
    }
  }
}

Use https://staging.iimmpact.com/mcp with staging credentials while validating an integration. See the public MCP reference for the tool catalog and write-confirmation requirements.

The process reads one JSON-RPC message per stdin line and writes JSON-RPC responses to stdout. Diagnostics go only to stderr. HTTP is rejected unless the URL host is loopback (localhost, 127.0.0.1, or ::1). The bridge accepts no credential arguments, uses a fresh timestamp and nonce for every request, and never includes upstream HTTP response bodies in transport errors.

Topup idempotency

The client creates the refid, which acts as the topup idempotency key within the authenticated reseller. For a retry or status check, resend the same valid topup input with the same refid; an existing transaction is returned with its current status instead of creating another topup. Use a new unique refid only when intentionally creating a new topup; UUID v4 is recommended. Generate it before preview and keep both the input and refid unchanged through preview, confirmation, status checks, and retries.

The client supports JSON responses, SSE data: frames, and notification 202 responses. Notification transport failures do not produce synthetic JSON-RPC responses. Requests are serialized so the protocol version negotiated by initialize is attached to all subsequent requests. Set IIMMPACT_MCP_PROTOCOL_VERSION to pin and forward a version from the first request when required by a latest stateless client. IIMMPACT_MCP_TIMEOUT_MS defaults to 120000 and accepts 35000-300000 milliseconds so the bridge waits longer than the API request window.

If a write tool's connection fails after sending, the bridge reports the outcome as uncertain instead of encouraging a blind retry. For topup, check status or retry with the same refid. The bridge does not implement stateful MCP sessions, resumable SSE streams, server-to-client requests, or JSON-RPC batch input.