harukibox

com.harukiboxPublished by harukibox.comOfficial publisherv0.2.1Updated Oct 24, 2026

Run a Japan proxy-buying business from your AI: inventory, orders, buyers, shipping fee split.

VerifiedStreamable HTTPWeb executableProductivity & WorkflowBusiness & Commerce

Overview

AI-generated overview

MCP server for harukibox that lets an AI agent manage a Japan proxy-buying business: products, orders, buyers and shipments.

What you can do
  • Read account and token info for the current user or organization
  • List and fetch products, and create new products
  • List orders (registrations) and buyers
  • List shipments
  • Run a global search across the account
When to use it
Useful if you run a Japan proxy-buying (daigou) business on harukibox and want an assistant to look up products, orders, buyers and shipments, or add products, without opening the dashboard.
Requirements
A harukibox account and an API token obtained through the harukibox CLI OAuth login (or generated in the account settings), supplied as the HARUKIBOX_TOKEN environment variable. Runs as a local npm package (Node.js) or as a remote endpoint; HARUKIBOX_BASE_URL can point at a self-hosted instance. Network access to the harukibox API.
Before you install
The token is a live credential (hrk_live_ prefix) and grants access to business data; keep it out of shared configs. Creating products writes data to the account. Every call is written to a server-side audit log with no web UI to review it. The optional refresh-token mode can revoke all of a user's tokens if the process restarts with a stale refresh token, so it is off by default.

Installation

In SourceWeft

  1. Open harukibox in the dashboard and add it to a workspace.
  2. Connect the required credentials. They are stored privately and never shown on public pages.
  3. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/com.harukibox%2Fharukibox/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config. The client completes OAuth sign-in on first connect.

{
  "mcpServers": {
    "harukibox": {
      "type": "http",
      "url": "https://harukibox.com/api/agent/mcp"
    }
  }
}

README

@harukibox/mcp

Model Context Protocol server for harukibox — let your AI agent manage your 代購 inventory, orders, buyers and shipments through the official Agent API.

協定版本

實作 MCP 2026-07-28（stateless、server/discover、resultType、cacheable tools/list），同時維持 dual-era：舊版的 initialize handshake 照樣回應。

也就是說現在的 Claude Desktop / Claude Code（仍在 2025-11-25 以前）不用改任何設定 就能繼續用；等 client 升級到 2026-07-28 後會自動走新路徑，一樣不用改設定。

@modelcontextprotocol/sdk 最新的 1.30.0 仍停在 2025-11-25，沒有 server/discover / resultType / CacheableResult，所以本 server 直接輸出 wire format 而不透過 SDK（也因此本套件零 runtime 相依）。SDK 支援新版後會換回去。

安裝

bash
npm install -g @harukibox/mcp

或在專案內：

bash
npm install @harukibox/mcp

取得 API token

透過 @harukibox/cli 跑 OAuth 取得（90 天有效）：

bash
npm install -g @harukibox/cliharukibox login           # PKCE，預設打開瀏覽器# 或無 GUI 環境：harukibox login --device  # device flow，顯示 user_code 讓你在瀏覽器輸入

跑完 token 會寫進 ~/.config/harukibox/config.json（mode 0600）。把該 token 設成 HARUKIBOX_TOKEN 即可。

Claude Desktop 設定

編輯 ~/Library/Application Support/Claude/claude_desktop_config.json：

json
{  "mcpServers": {    "harukibox": {      "command": "harukibox-mcp",      "env": {        "HARUKIBOX_TOKEN": "hrk_live_your_token_here"      }    }  }}

Refresh token (進階, 預設關閉)

如果你跑 long-lived MCP process（不常重啟），可開 refresh：

json
"env": {  "HARUKIBOX_TOKEN": "hrk_live_...",  "HARUKIBOX_ENABLE_REFRESH": "1",  "HARUKIBOX_REFRESH_TOKEN": "hrk_refresh_..."}

⚠️ 限制：refresh rotation 後新 refresh 只在 process memory；process 重啟時 env 仍是舊 refresh，server 會視為 reuse 並撤該 user 所有 token。重啟前請手動執行 harukibox login 取新 token。建議 production 不開此選項，依賴 90 天到期後 re-OAuth。

Claude Code 設定

bash
claude mcp add harukibox --command harukibox-mcp --env HARUKIBOX_TOKEN=hrk_live_your_token_here

可用工具

Tool必要 scope說明
haruki_meme取得當前 user/organization/token info
haruki_list_productsproducts:read列出商品
haruki_get_productproducts:read取得單一商品
haruki_create_productproducts:write建立商品
haruki_list_registrationsregistrations:read列出訂單
haruki_list_buyersbuyers:read列出買家
haruki_list_shippingsshippings:read列出出貨
haruki_searchsearch全域搜尋

安全

  • Token 一律以環境變數提供，不會寫入磁碟
  • 所有請求走 HTTPS 並帶 sha256 hash 驗證
  • 過期 / 撤銷 / IP allowlist 不符時請求會立刻被拒
  • 每次呼叫會被寫入伺服器端 audit log（沒有 web UI 查詢；如需匯出請與服務方聯繫）

自架 / 私有部署

bash
HARUKIBOX_BASE_URL=https://your-instance.example.com/api/agent \HARUKIBOX_TOKEN=hrk_live_... \harukibox-mcp

License

MIT

Source: packages/mcp/README.md at commit 3da75ec

Tools

0
This server asks you to sign in, so SourceWeft could not read its tools without an account and has not indexed them. What a connected account sees can depend on that account and its permissions.

Version history

1
  1. v0.2.1LatestSep 16, 2026

Score

85% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts