agentleFS
Sign inStart free
roedyrustamroedyrustam/doku-gemini-mcp/AGENTS.md

doku-gemini-mcp

AGENTS.md2 starsChanged 8 days agoMITView on GitHub

This document specifies mandatory rules, security requirements, signature formulas, and MCP tool design standards for agents interacting with DOKU Payment Gateway integrations (Jokul API v2 & SNAP API v1.0) and DOKU MCP Servers based on official developers.doku.com documentation.

  • Reads credentials

The file

We split this AGENTS.md into the rules it gives an agent

5 rules. About 0 are common, 1 is distinctive, and 4 are very specific to this project.

  • ≈0

    Common · estimate

    Many files like this have a rule of this kind.

  • ≈1

    Distinctive · estimate

    This author's own choices. Worth a look.

  • 4

    Very specific

    Tied to their project's names, files or tools. Probably skip.

  • Common
  • Distinctive
  • Very specific
  1. Very specific:

    Keep separate credentials for Sandbox (https://api-sandbox.doku.com) and Production (https://api.doku.com).

    line 10
  2. Very specific:

    NEVER: add a trailing newline (\n) at the end of the raw component string.

    line 29
  3. Very specific:

    ALL incoming HTTP webhook notifications from DOKU MUST be cryptographically verified using HMAC-SHA256 / SNAP X-SIGNATURE before updating …

    line 43
  4. Very specific:

    Use timing-safe string comparison (crypto.timingSafeEqual) when validating incoming signature headers to prevent timing side-channel …

    line 45
  5. Distinctive:

    Every MCP Tool definition MUST include explicit JSON Schema types, clear parameter descriptions, and required fields.

    line 52

≈ “Common” is an estimate: at least 1 in 5 of the 40,246 AGENTS.md files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.

Keep what fits and drop the rest. Your version, ready for your agents.
Files
AGENTS.md

Antigravity Rules for doku-gemini-mcp Plugin

This document specifies mandatory rules, security requirements, signature formulas, and MCP tool design standards for agents interacting with DOKU Payment Gateway integrations (Jokul API v2 & SNAP API v1.0) and DOKU MCP Servers based on official developers.doku.com documentation.

1. Secrets & Credentials Safety

  • NEVER hardcode DOKU_CLIENT_ID or DOKU_SECRET_KEY directly in source code, tests, or repository files.
  • ALWAYS inject API keys via environment variables (process.env.DOKU_CLIENT_ID, process.env.DOKU_SECRET_KEY).
  • Keep separate credentials for Sandbox (https://api-sandbox.doku.com) and Production (https://api.doku.com).

2. Signature Calculation Strictness

Jokul API v2 Standard

  • Mandatory HTTP Request Headers:
    • Client-Id: Merchant Client ID from DOKU Back Office.
    • Request-Id: Unique UUID v4 per HTTP request.
    • Request-Timestamp: UTC ISO8601 string without milliseconds, e.g. 2026-08-09T00:00:00Z (new Date().toISOString().replace(/\.\d{3}Z$/, 'Z')).
    • Signature: Format HMACSHA256=<base64-signature>.
  • Note: Request-Target and Digest are used only for Signature calculation component string. Do NOT send them as HTTP Request Headers.
  • Component String Assembly MUST strictly follow:
    Client-Id:<CLIENT_ID>\nRequest-Id:<REQUEST_ID>\nRequest-Timestamp:<TIMESTAMP>\nRequest-Target:<TARGET_PATH>\nDigest:<DIGEST_STRING>
  • NEVER add a trailing newline (\n) at the end of the raw component string.
  • For GET requests (e.g. Check Status API /orders/v1/status/:invoice_number), completely omit \nDigest:<DIGEST_STRING> from component assembly.

SNAP API v1.0 Standard

  • Mandatory SNAP Headers: X-TIMESTAMP, X-SIGNATURE, X-CLIENT-KEY, X-PARTNER-ID, X-EXTERNAL-ID, CHANNEL-ID.
  • Symmetric String to Sign Assembly:
    HTTPMethod + ":" + EndpointUrl + ":" + AccessToken + ":" + Lowercase(HexEncode(SHA-256(MinifiedRequestBody))) + ":" + Timestamp
  • Signature calculation uses HMAC-SHA512 with the Secret Key.

3. Webhook Signature Verification & Idempotency

  • ALL incoming HTTP webhook notifications from DOKU MUST be cryptographically verified using HMAC-SHA256 / SNAP X-SIGNATURE before updating database or order status.
  • Unverified requests MUST be immediately rejected with HTTP 401 Unauthorized.
  • Use timing-safe string comparison (crypto.timingSafeEqual) when validating incoming signature headers to prevent timing side-channel attacks.
  • Prevent duplicate webhook processing by performing atomic database transaction checks before triggering order fulfillment.
  • Sanitize payload logs to prevent sensitive customer PII or secret key leakage in application stdout/logs.

4. MCP Payment Tool & API Standards

  • Every MCP Tool definition MUST include explicit JSON Schema types, clear parameter descriptions, and required fields.
  • Monetary amount inputs MUST be specified as IDR integers without decimal places unless required by specific bank channel rules.
  • MCP Tools MUST catch network and API authorization errors gracefully without leaking raw stack traces to the LLM context.
  • DOKU MCP Servers MUST default to DOKU_IS_PRODUCTION=false (Sandbox) unless explicitly configured for production deployment.

Download now (ZIP)

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

No reviews yet

People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.

  • It worked
  • Partly
  • It didn't
What did you use it for? e.g. Reviewing pull requests in a Rails app

Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free