How to Give an LLM Agent Access to Yandex Webmaster: Anatomy of an MCP Server over an External API
Яндекс
The article explains how to build an MCP server that gives LLM agents access to Yandex Webmaster's API. It covers grouping dozens of endpoints into eight flexible tools, handling API quirks, and implementing an interactive OAuth login with loopback redirect so the agent can authorize itself. The server is open-source under MIT and written in TypeScript.
The author describes building an MCP server for Yandex Webmaster, which provides search analytics, indexing data, diagnostics, sitemaps, external links, and a recrawl submission feature. The key design choice is to group around two dozen endpoints into eight tools named by question rather than by endpoint: get_hosts, search_queries, get_indexing, get_diagnostics, list_sitemaps, get_external_links, recrawl_status, and recrawl_submit. This reduces model confusion from similar tool names. Several practical API pitfalls are covered: user_id must be fetched first; arrays are sent as repeated keys rather than CSV; 403 vs 401 are handled differently (403 means no rights to the host); different endpoints return different response shapes; error envelopes and auth header (OAuth instead of Bearer) differ from Yandex Metrica; throttling includes 429, 420, and quota error codes; recrawl is POST with JSON; empty responses should not be parsed. The interactive login uses authorization code with PKCE. Loopback redirect (http://127.0.0.1:53682/callback) is allowed by Yandex, contrary to the author's earlier belief, and eliminates code copy-paste. The port must be fixed to match redirect_uri, state is required for security, and fallback to manual code entry only on bind errors. Additionally, login is exposed as an MCP tool itself, so the agent can initiate login on its own without terminal access.
- Сокращения
- MCP = Model Context Protocol — Model Context Protocol
- API = Application Programming Interface — программный интерфейс приложения
- OAuth = Open Authorization — открытая авторизация
- PKCE = Proof Key for Code Exchange — доказательство ключа для обмена кодом
- HTTP = Hypertext Transfer Protocol — протокол передачи гипертекста
- URL = Uniform Resource Locator — единообразный указатель ресурса
- JSON = JavaScript Object Notation — JavaScript Object Notation
- CI = Continuous Integration — непрерывная интеграция
- RFC = Request for Comments — запрос комментариев
- SHA-256 = Secure Hash Algorithm 256-bit — алгоритм безопасного хеширования 256 бит
Source: Habr — хаб ИИ —
original
