- Node.js 20 or later
- npm
- A Steam Web API key for testing authenticated tools (free at https://steamcommunity.com/dev/apikey)
git clone https://github.com/TMHSDigital/Steam-MCP.git
cd Steam-MCP
npm install
npm run buildSet your API key for testing:
# PowerShell
$env:STEAM_API_KEY = "your_key_here"
# Bash
export STEAM_API_KEY="your_key_here"Run in development mode (auto-reloads on changes):
npm run dev-
Create a new file in
src/tools/(e.g.src/tools/getReviews.ts). -
Follow the existing pattern - export a
registerfunction:
import { z } from "zod";
import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
import { steamStoreUrl, steamFetch, errorResponse } from "../utils/steam-api.js";
const inputSchema = {
appid: z.number().int().positive().describe("Steam application ID"),
};
export function register(server: McpServer): void {
server.tool(
"steam_getReviews",
"Description of what this tool does. Mention if API key is required.",
inputSchema,
async ({ appid }) => {
try {
const url = steamStoreUrl("/appreviews/" + appid, { json: 1 });
const data = await steamFetch(url);
return {
content: [{ type: "text", text: JSON.stringify(data, null, 2) }],
};
} catch (error) {
return errorResponse(error);
}
},
);
}- Import and register it in
src/index.ts:
import { register as registerGetReviews } from "./tools/getReviews.js";
// ...
registerGetReviews(server);-
If the tool needs an API key, use
requireApiKey()fromsteam-api.tsand mention it in the tool description. -
Build and test:
npm run build- TypeScript with strict mode enabled
- Never use em dashes. Use a regular dash or rewrite the sentence.
- Never hardcode API keys. Always read from
STEAM_API_KEYenvironment variable. - Every tool should have a clear description and well-typed zod input schema with
.describe()on each field. - Wrap all tool handlers in try/catch and use
errorResponse()for error formatting.
- One tool per PR when adding new tools
- Include the Steam API endpoint URL in the PR description
- Note whether the endpoint requires authentication
- Test with real Steam API calls before submitting
- Keep changes focused - avoid unrelated refactors in the same PR
- Make sure
npm run buildpasses with no errors
This project uses CC-BY-NC-ND-4.0 as its outbound license, which forbids derivatives. Every pull request is a derivative. Contributions are accepted inbound under a broader grant via the Developer Certificate of Origin (DCO), which resolves the conflict so the project can accept and redistribute contributions.
By submitting a contribution to this repository, you certify that you have the right to do so under the Developer Certificate of Origin (DCO) 1.1, and you grant TMHSDigital a perpetual, worldwide, non-exclusive, royalty-free, irrevocable license to use, reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute your contribution under the project's current license (CC-BY-NC-ND-4.0) or any successor license chosen by the project.
Every commit in a pull request must have a Signed-off-by: trailer matching the commit author:
Signed-off-by: Jane Developer <jane@example.com>
Signing is done at commit time:
git commit -s -m "feat: add new skill"The GitHub DCO App enforces this on every PR.
For the full inbound/outbound model and rationale, see standards/licensing.md in the Developer-Tools-Directory meta-repo.