Sign JWT logins in LOGIN_TOKEN and add the noon Marketplace adapter

CITATION.cff

@@ -13,7 +13,7 @@ abstract: >
   server that turns REST/OpenAPI, SOAP/WSDL and GraphQL APIs, SQL/NoSQL
   databases and other MCP servers into tools for AI clients such as Claude,
   ChatGPT, Google Gemini, GitHub Copilot and Cursor, without writing code.
-  It ships 544 pre-built adapters, with a focus on ERP and e-commerce
+  It ships 545 pre-built adapters, with a focus on ERP and e-commerce
   systems (SAP Business One, Odoo, Xentral, JTL-Wawi, weclapp, Shopware,
   WooCommerce, Amazon Seller, Kaufland, OTTO, etc.), a per-workspace
   knowledge graph served over MCP, per-tool response mapping,

README.de.md

@@ -1,5 +1,5 @@
 <p align="center">
-  <img src="https://raw.githubusercontent.com/HelpCode-ai/anythingmcp/badges/banner.de.png" alt="AnythingMCP macht ERP-, E-Commerce-, REST-, SOAP- und SQL-Systeme zu MCP-Tools für Claude und ChatGPT: 544 Connectors, 25 davon ohne API-Schlüssel." width="100%" />
+  <img src="https://raw.githubusercontent.com/HelpCode-ai/anythingmcp/badges/banner.de.png" alt="AnythingMCP macht ERP-, E-Commerce-, REST-, SOAP- und SQL-Systeme zu MCP-Tools für Claude und ChatGPT: 545 Connectors, 25 davon ohne API-Schlüssel." width="100%" />
 </p>
 
 <h1 align="center">AnythingMCP: selbst gehostetes MCP-Gateway</h1>
@@ -19,7 +19,7 @@
 
 <p align="center">
   <strong>AnythingMCP ist ein quelloffenes, selbst gehostetes MCP-Gateway, das jedes REST-/OpenAPI-, SOAP-, GraphQL-, OData- oder SQL-System in MCP-Tools für Claude, ChatGPT und Copilot verwandelt, ohne dass du einen MCP-Server programmierst.</strong><br/>
-  Es bringt 544 fertige Adapter mit, darunter SAP, Etsy, weclapp und Amazon Seller; 25 davon kommen ohne API-Schlüssel aus.
+  Es bringt 545 fertige Adapter mit, darunter SAP, Etsy, weclapp und Amazon Seller; 25 davon kommen ohne API-Schlüssel aus.
 </p>
 
 <p align="center">
@@ -111,7 +111,7 @@ Tools werden zur Laufzeit registriert, ohne Neustart. `{{VAR}}`-Werte pro Connec
 
 ## Connector-Katalog
 
-544 Adapter mit über 2.400 Tools. Zu jedem gibt es eine Einrichtungsanleitung auf [anythingmcp.com/de/guides](https://anythingmcp.com/de/guides), in sieben Sprachen.
+545 Adapter mit über 2.400 Tools. Zu jedem gibt es eine Einrichtungsanleitung auf [anythingmcp.com/de/guides](https://anythingmcp.com/de/guides), in sieben Sprachen.
 
 | Kategorie | Beispiele |
 |---|---|

README.ja.md

@@ -1,5 +1,5 @@
 <p align="center">
-  <img src="https://raw.githubusercontent.com/HelpCode-ai/anythingmcp/badges/banner.ja.png" alt="AnythingMCP は ERP、E コマース、REST、SOAP、SQL の各システムを Claude と ChatGPT 用の MCP ツールに変換します。544 のコネクター、うち 25 は API キー不要。" width="100%" />
+  <img src="https://raw.githubusercontent.com/HelpCode-ai/anythingmcp/badges/banner.ja.png" alt="AnythingMCP は ERP、E コマース、REST、SOAP、SQL の各システムを Claude と ChatGPT 用の MCP ツールに変換します。545 のコネクター、うち 25 は API キー不要。" width="100%" />
 </p>
 
 <h1 align="center">AnythingMCP：セルフホスト型 MCP ゲートウェイ</h1>
@@ -19,7 +19,7 @@
 
 <p align="center">
   <strong>AnythingMCP は、オープンソースのセルフホスト型 MCP ゲートウェイです。MCP サーバーを書かずに、REST/OpenAPI、SOAP、GraphQL、OData、SQL のあらゆるシステムを Claude、ChatGPT、Copilot 用の MCP ツールに変換します。</strong><br/>
-  SAP、Etsy、weclapp、Amazon Seller などを含む 544 種類の既製アダプターを同梱しており、うち 25 は API キー不要です。
+  SAP、Etsy、weclapp、Amazon Seller などを含む 545 種類の既製アダプターを同梱しており、うち 25 は API キー不要です。
 </p>
 
 <p align="center">
@@ -111,7 +111,7 @@ amd64 ではイメージの取得に約 30 秒、その 24 秒後に API が利
 
 ## コネクターカタログ
 
-544 個のアダプターで 2,400 以上のツールを提供しています。どのアダプターにも [anythingmcp.com/ja/guides](https://anythingmcp.com/ja/guides) に 7 言語の設定ガイドがあります。
+545 個のアダプターで 2,400 以上のツールを提供しています。どのアダプターにも [anythingmcp.com/ja/guides](https://anythingmcp.com/ja/guides) に 7 言語の設定ガイドがあります。
 
 | カテゴリー | 例 |
 |---|---|

README.md

@@ -1,5 +1,5 @@
 <p align="center">
-  <img src="https://raw.githubusercontent.com/HelpCode-ai/anythingmcp/badges/banner.png" alt="AnythingMCP turns ERP, e-commerce, REST, SOAP and SQL systems into MCP tools for Claude and ChatGPT: 544 connectors, 25 of them with no API key." width="100%" />
+  <img src="https://raw.githubusercontent.com/HelpCode-ai/anythingmcp/badges/banner.png" alt="AnythingMCP turns ERP, e-commerce, REST, SOAP and SQL systems into MCP tools for Claude and ChatGPT: 545 connectors, 25 of them with no API key." width="100%" />
 </p>
 
 <h1 align="center">AnythingMCP: self-hosted MCP gateway</h1>
@@ -19,7 +19,7 @@
 
 <p align="center">
   <strong>AnythingMCP is an open-source, self-hosted MCP gateway that turns any REST/OpenAPI, SOAP, GraphQL, OData or SQL system into MCP tools for Claude, ChatGPT and Copilot, without writing an MCP server.</strong><br/>
-  It ships 544 ready connectors, among them SAP, Etsy, weclapp and Amazon Seller, and 25 of them need no API key.
+  It ships 545 ready connectors, among them SAP, Etsy, weclapp and Amazon Seller, and 25 of them need no API key.
 </p>
 
 <p align="center">
@@ -103,7 +103,7 @@ Tools register at runtime, without a restart. Per-connector `{{VAR}}` values are
 
 ## Connector catalog
 
-544 adapters, exposing 2,400+ tools. Every one has a setup guide on [anythingmcp.com/guides](https://anythingmcp.com/guides), in seven languages.
+545 adapters, exposing 2,400+ tools. Every one has a setup guide on [anythingmcp.com/guides](https://anythingmcp.com/guides), in seven languages.
 
 | Category | Examples |
 |---|---|

README.zh-CN.md

@@ -1,5 +1,5 @@
 <p align="center">
-  <img src="https://raw.githubusercontent.com/HelpCode-ai/anythingmcp/badges/banner.zh-CN.png" alt="AnythingMCP 将 ERP、电子商务、REST、SOAP 和 SQL 系统转化为 Claude 和 ChatGPT 可用的 MCP 工具：544 个连接器，其中 25 个无需 API 密钥。" width="100%" />
+  <img src="https://raw.githubusercontent.com/HelpCode-ai/anythingmcp/badges/banner.zh-CN.png" alt="AnythingMCP 将 ERP、电子商务、REST、SOAP 和 SQL 系统转化为 Claude 和 ChatGPT 可用的 MCP 工具：545 个连接器，其中 25 个无需 API 密钥。" width="100%" />
 </p>
 
 <h1 align="center">AnythingMCP：自行托管的 MCP 网关</h1>
@@ -19,7 +19,7 @@
 
 <p align="center">
   <strong>AnythingMCP 是一个开源、可自行托管的 MCP 网关，无需编写 MCP 服务器，即可将任意 REST/OpenAPI、SOAP、GraphQL、OData 或 SQL 系统转化为 Claude、ChatGPT 和 Copilot 可用的 MCP 工具。</strong><br/>
-  它自带 544 个现成适配器，涵盖 SAP、Etsy、weclapp 和 Amazon Seller 等，其中 25 个无需 API 密钥。
+  它自带 545 个现成适配器，涵盖 SAP、Etsy、weclapp 和 Amazon Seller 等，其中 25 个无需 API 密钥。
 </p>
 
 <p align="center">
@@ -111,7 +111,7 @@ docker compose up -d
 
 ## 连接器目录
 
-共 544 个适配器，提供 2,400 多个工具。每个适配器都在 [anythingmcp.com/zh/guides](https://anythingmcp.com/zh/guides) 上提供七种语言的配置指南。
+共 545 个适配器，提供 2,400 多个工具。每个适配器都在 [anythingmcp.com/zh/guides](https://anythingmcp.com/zh/guides) 上提供七种语言的配置指南。
 
 | 类别 | 示例 |
 |---|---|

docs/connectors/login-token-auth.md

@@ -97,6 +97,16 @@ The token cache is keyed by `connectorId` (when available) or by `loginUrl|usern
     "outputParam": "passwordHashed"  // name exposed to the body template (default: passwordHashed)
   },
 
+  // ─── Or: a JWT signed with the account's private key (no password) ─
+  "signedJwt": {
+    "privateKey": "{{SERVICE_PRIVATE_KEY}}", // PEM, PKCS#1 / PKCS#8 / SEC1
+    "algorithm":  "RS256",                   // RS256 (default) | RS384 | RS512 | PS256 | ES256 | ES384
+    "claims":     { "sub": "{{SERVICE_KEY_ID}}" },
+    "keyId":      "…",                       // optional `kid` header
+    "ttlSeconds": 300,                       // optional; adds exp = iat + ttlSeconds
+    "outputParam": "signedJwt"               // name exposed to the body template (default: signedJwt)
+  },
+
   // ─── Where to find the token & expiry in the login response ────
   "tokenJsonPath":  "data.signIn.jwtToken.token",
   "expiryJsonPath": "data.signIn.jwtToken.expiredAt",
@@ -133,9 +143,30 @@ The placeholders below are substituted by the engine when rendering `loginBody`
 | `${passwordHashed}` | output of the password preprocessor (renamed via `outputParam`) |
 | `${aud}` | `authConfig.aud` |
 | `${otp}` | `authConfig.otp` |
+| `${signedJwt}` | a JWT signed for this login (see below; renamed via `outputParam`) |
 
 In `headerTemplate` and `extraHeaders`, only `${token}` and `${aud}` are available (these refer to the issued token, not the credentials).
 
+### Signed JWT logins
+
+Some APIs take no password: the client signs a short JWT with the private key
+of a service account and posts it to the login endpoint (noon's Partner API:
+RS256, `sub` = the key id, then the session comes back as cookies). With
+`signedJwt` set, `username` and `password` are not required, and every login
+signs a new token: `iat` is the current time in whole seconds, `jti` a random
+UUID, then the configured `claims`; `exp` is added only when `ttlSeconds` is
+set. A claim whose `{{VARIABLE}}` has no value stops the login with an error
+that names it. The key is read as for OAuth2 `private_key_jwt` client
+assertions: a PEM pasted on one line or with literal `\n` works, an encrypted
+key is refused, and no error message contains key material.
+
+```json
+"loginBody": { "token": "${signedJwt}", "default_project_code": "{{NOON_PROJECT_CODE}}" },
+"signedJwt": { "privateKey": "{{NOON_PRIVATE_KEY}}", "algorithm": "RS256", "claims": { "sub": "{{NOON_KEY_ID}}" } },
+"tokenSource": "cookie",
+"cookieMode": "all"
+```
+
 ### Expiry formats
 
 | `expiryFormat` | Value at `expiryJsonPath` |
@@ -172,6 +203,7 @@ whole body, for logins that answer with a bare token string).
 
 ## Security notes
 
+- **Private keys never leave the server.** With `signedJwt`, only the signed token is sent; the key stays in encrypted storage like a password.
 - **Plain passwords never leave the server.** Only the bcrypt hash is sent over the wire; the plain password lives only in encrypted `authConfig` storage.
 - The encrypted `authConfig` is decrypted in-process at request time and never logged.
 - Tokens persisted in `connector_auth_cache` are encrypted with the same AES-256-GCM key (`ENCRYPTION_KEY` env var).

docs/tool-definition.md

@@ -941,7 +941,7 @@ to every connector type, not just REST.
 
 ## Authentication: `LOGIN_TOKEN`
 
-In addition to the standard `NONE` / `API_KEY` / `BEARER_TOKEN` / `BASIC_AUTH` / `OAUTH2` / `QUERY_AUTH` / `WS_SECURITY` / `CERTIFICATE` / `CONNECTION_STRING` schemes, the connector spec supports `LOGIN_TOKEN` for APIs that issue a long-lived bearer **in exchange for a credentials POST** — optionally requiring the password to be **bcrypt-hashed with a salt fetched from the remote service** (Sorare-style).
+In addition to the standard `NONE` / `API_KEY` / `BEARER_TOKEN` / `BASIC_AUTH` / `OAUTH2` / `QUERY_AUTH` / `WS_SECURITY` / `CERTIFICATE` / `CONNECTION_STRING` schemes, the connector spec supports `LOGIN_TOKEN` for APIs that issue a long-lived bearer **in exchange for a credentials POST** — optionally requiring the password to be **bcrypt-hashed with a salt fetched from the remote service** (Sorare-style). APIs that log in with a JWT the client signs with its own private key instead of a password (noon's Partner API) use `signedJwt`.
 
 The engine handles salt fetch → bcrypt → login → token cache → proactive refresh → re-login-on-401 automatically. Adapter authors declare the full flow as JSON:
 

glama.json

@@ -3,5 +3,5 @@
   "maintainers": [
     "helpcodeai"
   ],
-  "description": "Turn any REST/OpenAPI, SOAP/WSDL, GraphQL, OData or SQL API into MCP tools for Claude, ChatGPT and Copilot, no code. 544 pre-built adapters for ERP and e-commerce (SAP S/4HANA, SAP Business One, Odoo, Xentral, JTL-Wawi, weclapp, Shopware, WooCommerce, Amazon Seller, Kaufland, OTTO\u2026) and more. Self-hosted, knowledge graph, per-tool response mapping, OAuth2/RBAC/SSO/audit. Open source under AGPL-3.0."
+  "description": "Turn any REST/OpenAPI, SOAP/WSDL, GraphQL, OData or SQL API into MCP tools for Claude, ChatGPT and Copilot, no code. 545 pre-built adapters for ERP and e-commerce (SAP S/4HANA, SAP Business One, Odoo, Xentral, JTL-Wawi, weclapp, Shopware, WooCommerce, Amazon Seller, Kaufland, OTTO\u2026) and more. Self-hosted, knowledge graph, per-tool response mapping, OAuth2/RBAC/SSO/audit. Open source under AGPL-3.0."
 }

package.json

@@ -1,7 +1,7 @@
 {
   "name": "anythingmcp",
   "version": "0.47.2",
-  "description": "Turn any REST/OpenAPI, SOAP/WSDL, GraphQL, OData or SQL API into MCP tools for Claude, ChatGPT and Copilot, no code. 544 pre-built adapters for ERP, e-commerce and more (SAP S/4HANA, SAP Business One, Odoo, Xentral, JTL-Wawi, Shopware, WooCommerce, Amazon Seller). Self-hosted, open source (AGPL-3.0).",
+  "description": "Turn any REST/OpenAPI, SOAP/WSDL, GraphQL, OData or SQL API into MCP tools for Claude, ChatGPT and Copilot, no code. 545 pre-built adapters for ERP, e-commerce and more (SAP S/4HANA, SAP Business One, Odoo, Xentral, JTL-Wawi, Shopware, WooCommerce, Amazon Seller). Self-hosted, open source (AGPL-3.0).",
   "private": true,
   "license": "AGPL-3.0-only",
   "engines": {

packages/backend/src/adapters/catalog.spec.ts

@@ -368,15 +368,25 @@ describe('adapter catalog', () => {
         expect(typeof cfg.loginUrl).toBe('string');
         // Same rule as LoginTokenService: a token read from a cookie has no
         // JSON path, it names the cookie instead.
+        // With cookieMode "all" every cookie is the token and cookieName is
+        // optional.
         if (cfg.tokenSource === 'cookie') {
-          expect(typeof cfg.cookieName).toBe('string');
+          if (cfg.cookieMode !== 'all') expect(typeof cfg.cookieName).toBe('string');
         } else {
           expect(typeof cfg.tokenJsonPath).toBe('string');
         }
-        // performLogin refuses to start without both, even when the body
-        // does not use them.
-        expect(typeof cfg.username).toBe('string');
-        expect(typeof cfg.password).toBe('string');
+        if (cfg.signedJwt) {
+          // A signed-JWT login needs a key and has to send the token.
+          const jwt = cfg.signedJwt as Record<string, unknown>;
+          expect(typeof jwt.privateKey).toBe('string');
+          const param = typeof jwt.outputParam === 'string' ? jwt.outputParam : 'signedJwt';
+          expect(JSON.stringify(cfg.loginBody ?? cfg.loginBodyTemplate ?? '')).toContain(`\${${param}}`);
+        } else {
+          // performLogin refuses to start without both, even when the body
+          // does not use them.
+          expect(typeof cfg.username).toBe('string');
+          expect(typeof cfg.password).toBe('string');
+        }
         if (cfg.passwordHashing) {
           const ph = cfg.passwordHashing as Record<string, unknown>;
           expect(VALID_PASSWORD_HASHING_SCHEMES.has(String(ph.scheme))).toBe(true);

packages/backend/src/adapters/catalog.ts

@@ -338,6 +338,7 @@ import * as newsapi from './intl/newsapi.json';
 import * as nextcloud from './intl/nextcloud.json';
 import * as nimble from './intl/nimble.json';
 import * as nominatim from './intl/nominatim.json';
+import * as noonMarketplace from './intl/noon-marketplace.json';
 import * as noonPayments from './intl/noon-payments.json';
 import * as notion from './intl/notion.json';
 import * as novaPoshta from './intl/nova-poshta.json';
@@ -1122,6 +1123,7 @@ const RAW_ADAPTERS: AdapterDefinition[] = [
   nextcloud as unknown as AdapterDefinition,
   nimble as unknown as AdapterDefinition,
   nominatim as unknown as AdapterDefinition,
+  noonMarketplace as unknown as AdapterDefinition,
   noonPayments as unknown as AdapterDefinition,
   notion as unknown as AdapterDefinition,
   novaPoshta as unknown as AdapterDefinition,