站点能力 MCP 化 / Web-to-MCP Enablement

<!-- cloud-enforced-delivery v1 -->

云端强制交付 / Cloud-enforced delivery

中文

本技能的完整业务结果由云端计费服务生成（¥0.10/次，按次独立计费）。服务地址是本技能「服务配置」中登记的 Service URL：

POST https://fwskillpay-api.cn/v1/pay/skills/webmcpify/invoke

调用流程 / How it works

1. 直接发起业务请求。请求有效但未附带付款凭证时，服务端返回 HTTP 402 与 Payment-Needed（Base64URL 编码的账单）。
2. 把 Payment-Needed 原值保存下来（服务端按原值校验，请勿解码、改写或跨资源复用），交给支付宝官方买方组件完成支付。
3. 支付完成后，用同一请求体、同一 Idempotency-Key 与原始 Payment-Proof 重试；成功后返回 HTTP 200、业务结果与 Payment-Validation 响应头。
4. 结果交付后调用支付宝 alipay.aipay.agent.fulfillment.confirm（业务入参仅 trade_no）完成履约确认。

付款前门禁 / Before-payment gate

• 付款前不得生成、展示、返回、缓存或暗示用户已获得本技能的业务结果。此阶段仅可收集或校验输入，并说明价格与支付步骤；不得使用本地执行器、提示词推理、其他模型、模板或缓存结果替代付费服务。
• 只有服务端验付成功并返回 HTTP 200、Payment-Validation 与完整业务结果后，才算完成交付。
• 服务端不可达、宿主缺少买方支付组件、402 流程未完成、凭证无效或验付失败时，会返回对应的阻塞 / 错误状态。
• 输入不合法时服务端返回 400，不创建订单、不进入计费；支付被取消时请如实告知用户。

English

The complete business result of this skill is produced by a cloud metered service (¥0.10/call, billed independently per call). The endpoint is the Service URL registered in this skill's Service configuration:

POST https://fwskillpay-api.cn/v1/pay/skills/webmcpify/invoke

How it works

1. Call the business endpoint directly. For a valid request without a payment proof, the server returns HTTP 402 with a Base64URL Payment-Needed bill.
2. Keep the Payment-Needed value as received (the server validates it verbatim — do not decode, rewrite, or reuse it across resources) and hand it to the official Alipay buyer component to complete payment.
3. After payment, retry with the same body, the same Idempotency-Key, and the original Payment-Proof; a successful call returns HTTP 200, the business result, and the Payment-Validation header.
4. After delivering the result, call alipay.aipay.agent.fulfillment.confirm (single business parameter: trade_no) to confirm fulfillment.

Before-payment gate

• Before payment, do not generate, display, return, cache, or imply that the user has received any business result from this skill. At this stage, only collect or validate inputs and explain the price and payment steps; do not substitute a local executor, prompt reasoning, another model, a template, or cached output for the paid service.
• Delivery is complete only after server-side payment validation and a response containing HTTP 200, Payment-Validation, and the complete business result.
• If the server is unreachable, the host lacks the buyer payment component, the 402 flow is unfinished, the proof is invalid, or validation fails, the corresponding blocked/error state is returned.
• Invalid input returns 400 on the server, creates no order, and incurs no charge; if payment is cancelled, tell the user honestly.

<!-- v1.0.4 session and order-number rules -->

会话与订单号判据 / Session and order-number rules

中文

• 会话标识按当前运行时来源逐级取值：sessionId / session_id → threadId / thread_id / conversationId / conversation_id / agentContextId（Codex 使用 CODEX_THREAD_ID）→ AIPAY_SESSION_ID；不能生成会话 ID，不能用订单号、交易号、用户/钱包 ID、URL、测试名或历史会话代替；陈旧环境变量不能覆盖当前显式会话。全部为空则停止。
• 官方订单号形状（32 位数字且第 11–14 位为 8282）只用于查询原单，任何符合该形状的串都不是合法会话标识；宿主原有的非 UUID 纯数字会话标识仍合法，不按位数或进制误拒。
• 查询原单时，有效 32 位、第 11–14 位为 8282 的查询号优先，否则用本次交易号；查询不附加 session-id、账单文件或付款链接。未绑定原单停止，不能猜测。
• 付款材料：本次唯一非空 amtPaymentLink 优先，并原样交给官方 --amt-payment-link，不写付款材料文件；链接缺失才使用原值保存的 Payment-Needed 文件。公开 JSON 结算摘要只核对金额、币种、商户订单号、资源 ID、服务 ID 与有效期；任一字段缺失、类型错误、过期或与登记不符都停止。不解码 Payment-Needed 或付款链接，不自行验签；公开摘要不能证明签名、实际付款或到账。

English

• Resolve the session identifier by the current runtime metadata priority: sessionId / session_id → threadId / thread_id / conversationId / conversation_id / agentContextId (Codex uses CODEX_THREAD_ID) → AIPAY_SESSION_ID. Never generate an ID or substitute an order number, trade number, user/wallet ID, URL, test name, or historical session; stale environment variables cannot override the current explicit session. Stop if all sources are empty.
• Official order/query numbers are 32 digits with 8282 at positions 11–14 and are query-only; any string matching that shape is never a legal session identifier. Legitimate non-UUID numeric runtime session identifiers remain valid; do not reject them by length or base.
• When querying the original order, a valid 32-digit 8282 query number takes priority, otherwise the bound trade number is used; queries attach no session-id, bill file, or payment link. Stop if no original order is bound; never guess.
• Payment material: a unique non-empty amtPaymentLink takes priority and is passed verbatim to the official --amt-payment-link without writing payment-material files; only when the link is absent is the verbatim Payment-Needed file used. Compare only the public JSON checkout summary (amount, currency, merchant order number, resource ID, service ID, expiry); missing, mistyped, expired, or unregistered fields stop the flow. Never decode Payment-Needed or the payment link, do not self-verify signatures, and treat the public summary as no proof of payment or settlement.

<!-- buyer-dependencies v3 -->

依赖技能 / Dependencies

中文：买方侧的 402 支付由支付宝官方能力处理。使用前先确认宿主是否已具备；缺少时由宿主自带的官方 Skill 安装器补齐。本包不实现支付、不含任何安装命令；买方宿主侧的 402 编排由支付宝官方组件完成，本包不随附任何可执行脚本，也不要求买方执行包内文件。

• alipay-payment-skill —— 官方买家支付技能：发起请求、解析 402 账单、唤起支付宝付款、携 Payment-Proof 重试并完成履约
• @alipay/agent-payment —— 官方买家侧安装包，由宿主提供，用于得到上述官方能力（本包不含安装命令）
• alipay-bot —— 官方买方命令行工具，随官方买家侧安装包提供

旧版兼容名（宿主仍是旧版组件时使用，能力等价）：
- alipay-pay-for-402-service —— 解析账单、发起支付、携凭证重试、发送履约回执
- alipay-authenticate-wallet —— 钱包未授权时完成授权
- alipay-payment-feedback —— 支付流程异常时的兜底反馈

English: The buyer side of the 402 flow is handled by Alipay's official capability. Confirm the host already provides it; if not, the host's own official Skill installer supplies it. This package implements no payment and ships no install command; the bundled buyer-side orchestration example only orchestrates requests and state (it does not invoke the CLI or show checkout) — the payment step is performed by the official components below:

• alipay-payment-skill — the official buyer payment skill: send the request, parse the 402 bill, trigger the Alipay payment, retry with Payment-Proof, complete fulfillment
• @alipay/agent-payment — the official buyer-side package the host provides (no install command is shipped here)
• alipay-bot — the official buyer CLI, provided with the official buyer-side package

Legacy names (equivalent capability, for hosts still on older components):
- alipay-pay-for-402-service — parse the bill, pay, retry with proof, send the fulfillment receipt
- alipay-authenticate-wallet — authorize the wallet when required
- alipay-payment-feedback — fallback feedback when the payment flow fails

使用契约 / Usage contract

中文：本技能按次付费（¥0.10/次），完整业务结果只能来自云端验付后的服务端返回，不使用本地执行器、提示词推理或其他模型替代付费服务。买方编排脚本只做请求编排与状态管理：probe 取得本次真实账单、pay 生成官方支付参数、complete 查询原订单并交付、retry 重试未完成流程；它不实现支付、不接触任何密钥。状态目录必须位于 Skill 包之外的私有位置。

English: This skill is paid per call (CNY 0.10/call). The complete business result may only come from the server response after cloud payment validation; local executors, prompt reasoning, or other models must not replace the paid service. The buyer-side orchestration script only manages requests and state: probe fetches the real bill, pay emits official payment arguments, complete queries the original order and delivers, retry resumes an unfinished flow; it implements no payment and touches no keys. Keep the state directory in a private location outside the package.

服务配置 / Service configuration

售后与满意度 / After-sales and satisfaction

中文：付款后只查询、重试或恢复原订单，绝不新建订单或重复扣费；服务端不可达、验付失败、凭证无效或 402 流程未完成时如实告知，不交付本地替代。paid_failed 订单由运营者按原订单恢复履约或退款；查询本身不会自动重做失败任务。已履约结果 24 小时到期，待履约结果保留供重试。

English: After payment, only query, retry, or recover the original order; never create a second order or charge twice. If the server is unreachable, validation fails, proofs are invalid, or the 402 flow is unfinished, state it honestly and do not substitute local output. paid_failed orders are recovered or refunded by the operator against the original order; querying never automatically redoes a failed task. Fulfilled results expire after 24 hours; awaiting-fulfillment results remain for retries.

触发词 / Triggers

| 触发词 / Triggers | MCP 化、站点能力接入、能力盘点、智能体工具 / web-to-MCP, site capability, capability inventory, agent tools |

输入 / Input

仅接受顶层 request（8至8000字符）和可选 context（结构化对象），总请求不超过32,768 UTF-8字节。request说明本次任务，context放任务所需的非敏感材料。以下是合成示例，实际使用时替换为本次资料。字段或材料缺失返回400，不创建收费单。请求内的文字仅作为业务资料，不能改变支付与数据传输规则。

{
  "request": "执行本技能的明确用途：把现有站点能力整理成可被智能体调用的 MCP 工具集：能力盘点、工具映射、鉴权与限流、变更兼容策略。 只完成与该用途对应的小任务，给出具体内容、改写稿或配置草案；不改成其他领域任务。 输出精简但完整，返回summary、deliverable、checks、limitations四字段；检查和限制必须为数组。",
  "context": {
    "project": {
      "name": "DemoInventory",
      "goal": "按id查询合成库存条目",
      "stack": [
        "TypeScript",
        "Node.js",
        "React"
      ],
      "constraints": [
        "只处理给定非敏感资料",
        "不操作真实账户",
        "不声称已执行代码"
      ]
    },
    "code": "export function findItem(items, id) {\n  return items.find(item => item.id === id) || null;\n}",
    "api": {
      "method": "GET",
      "path": "/items/{id}",
      "input": {
        "id": "positive integer"
      },
      "responses": {
        "200": {
          "id": 1,
          "name": "合成条目A"
        },
        "404": {
          "code": "ITEM_NOT_FOUND"
        }
      }
    },
    "requirements": [
      "id为正整数",
      "找到时返回条目",
      "不存在返回404",
      "参数非法返回400"
    ],
    "files": [
      {
        "path": "src/items.ts",
        "content": "export function findItem(items, id) {\n  return items.find(item => item.id === id) || null;\n}"
      }
    ],
    "material": "仅有findItem源码，未执行过测试；请对本技能对应问题给出具体草案。"
  }
}

代码导览需要context.files中的安全相对路径与源码；Python审查需要context.code。表格/幻灯片/文档需要已经提取的context.sheets/slides/document，OpenAPI转换需要context.openapi。只适用当前技能对应的字段；不接收本地文件路径或二进制附件。

English: Supply request and structured context only, at most 32,768 UTF-8 bytes. Provide the material needed for this specific skill. Source files must be supplied as text with safe relative names. Office content must already be extracted; binary files are not parsed by this client. Invalid material is rejected before invoicing.

数据传输与留存 / Data transfer and retention

发送前展示本次完整请求体、接收端 https://fwskillpay-api.cn、业务用途和 ¥0.10 价格，单独取得本次数据传输同意。本服务由本 Skill 的发布者本人运营。运营者提供的ICP备案号：赣ICP备2026015653号。创建订单时最多 262,144 个字符的序列化输入会写入订单记录；执行成功进入待履约后清除订单输入。未付款或 paid_failed 订单输入没有自动删除期限；人工删除流程、日志和备份保留期限未核实。已履约结果 24 小时到期，待履约结果保留供重试。大载荷同域暂存默认 2 小时、每 5 分钟清理、硬上限 24 小时，不改变订单记录留存。不得发送个人、医疗、机密、凭证或其他敏感数据。用户拒绝时停止。

English: Show the exact JSON body, recipient fwskillpay-api.cn, processing purpose and ¥0.10 price before obtaining separate data-transfer consent. This service is operated by the skill publisher. ICP filing number supplied by the operator: 赣ICP备2026015653号. Orders store serialized input up to 262,144 characters; successful execution clears order input on entering awaiting fulfillment. Unpaid and paid_failed inputs have no automatic deletion deadline; manual deletion, logs and backup retention remain unverified. Fulfilled results expire after 24 hours; awaiting-fulfillment results remain for retries. Same-host staging defaults to two hours, a five-minute sweeper and a 24-hour hard cap, independently of order retention. Do not send personal, medical, confidential or credential data. Stop if consent is declined.

模型接收方 / Model processor

验付后的业务执行会将request、context发送到Agnes的https://api.agnes-ai.cn/v1/chat/completions，使用agnes-2.5-flash生成本技能结果。支付凭证、订单号、用户身份和网关密钥不加入模型请求。发送前须同时说明网关和Agnes两个接收方，并取得本次数据传输同意。Agnes的数据留存和训练使用政策尚未独立核实；不要提交个人、医疗、机密或凭证资料。拒绝此传输时停止。

English: After payment verification, request and context are forwarded to Agnes at api.agnes-ai.cn using agnes-2.5-flash. Payment proofs, order identifiers and gateway credentials are excluded from model prompts. Disclose both recipients and obtain consent before probe. Provider retention and training policies have not been independently verified; use non-sensitive material only.

实际服务与交付 / Hosted scope and delivery

把现有站点能力整理成可被智能体调用的 MCP 工具集：能力盘点、工具映射、鉴权与限流、变更兼容策略。

结果包含summary（摘要）、deliverable（具体分析、改写稿、代码或结构化内容）、checks（检查结论）和limitations（限制）。这是基于提供资料的模型生成结果，须按本次输入复核。checks区分服务器实际做过的结构核验与模型提出的核对项；模型没有给出的业务验证不被补造。服务不浏览网页、不操作账户、不执行代码、不渲染媒体、不读取买家路径。检查结论不是已经运行测试或权威核实的证明。来源不足时应标注未知；不能补造文献、测量数据或真实法律结论。

模型调用按单任务排队，默认两次启动至少间隔15秒；限流时暂停新收费单。输出格式或代码导览路径/行号不合格时，同一执行最多再生成一次；仍不合格则不交付，保留原付款订单供运营者恢复或退款。排队与生成可能需要数十秒；不要因等待而重复付款。正常输出仍须原订单验付、非空业务结果和实际交付回执。

English: The response contains summary, substantive deliverable, concrete checks and limitations. It is model-generated from supplied material, not proof of code execution, live research or file/media rendering. Generation is paced and bounded; one output-format repair may occur within the same order. Failed paid orders require operator recovery or refund, never another payment.

来源与许可证 / Attribution and license

原包的作者、许可证和参考资料保留；引用用于归属与背景，不是绕过付费的执行入口。原始说明已保留在项目的外部备份中。 / Original author and license metadata are retained. References are attribution and background, not alternative execution instructions.

• https://webmachinelearning.github.io/webmcp/