PipSync

Additional hardening available on Enterprise:IP allowlist(restrict which CIDR ranges may use a key) andIP blocklist. Both configured per-key from the same settings page.

Limits are per API key per rolling 60-second window. Webhooks are separately rate-limited on their inbound delivery surface.

Every API response includes rate-limit headers so your integration can stay within bounds without trial and error:

429 responses are retryable.Always readRetry-Afterand honour it. Do not hard-code a sleep duration — the exact window depends on your plan and current load.

Implement jittered exponential backoff whenever you receive a 429. This pattern prevents thundering-herd issues if your fleet is calling in parallel:

async function fetchWithRetry(url, key, maxRetries = 4) { for (let attempt = 0; attempt <= maxRetries; attempt++) { const res = await fetch(url, { headers: { Authorization: \Bearer ${key}\ }, }); if (res.status !== 429) return res.json(); const retryAfter = parseInt(res.headers.get("Retry-After") ?? "1", 10); const backoff = retryAfter  1000  Math.pow(2, attempt) + Math.random() * 200; await new Promise(r => setTimeout(r, backoff)); } throw new Error("Rate limit retries exhausted"); }

{ "type": "https://app.pipsync.io/errors/unauthorized", "title": "Unauthorized", "status": 401, "detail": "Missing or invalid API key" }

Returns the profile of the workspace owner associated with the API key.

curl https://app.pipsync.io/api/v1/me \ -H "Authorization: Bearer $PIPSYNC_KEY"

Returns parsed trading signals for the workspace. Signals are the normalized output of the parser — ready for downstream processing.

curl "https://app.pipsync.io/api/v1/signals?limit=10" \ -H "Authorization: Bearer $PIPSYNC_KEY"

Returns trade records (opened, closed, partially-closed positions) for the workspace. Paginated; newest trades first.

curl "https://app.pipsync.io/api/v1/trades?limit=25" \ -H "Authorization: Bearer $PIPSYNC_KEY"

Enumerate generated trade reports and download links. Use/v1/reports/tradesto get the detailed line-item CSV/PDF export.

POSTyour-server.com/pipsync —signed by X-PipSync-Signature

Every webhook delivery includes anX-PipSync-Signatureheader formatted ast=<unix-ts>,v1=<hex-hmac-sha256>. Verify before trusting the payload:

import crypto from "crypto"; export function verifyWebhook(rawBody: string, header: string, secret: string): boolean { const parts = Object.fromEntries( header.split(",").map((part) => part.split("=")), ); const signed = parts.t + "." + rawBody; const expected = crypto .createHmac("sha256", secret) .update(signed) .digest("hex"); // Constant-time comparison to prevent timing attacks return crypto.timingSafeEqual( Buffer.from(expected), Buffer.from(parts.v1 ?? ""), ); }

Always verify the timestamp.Reject payloads wheretis more than 5 minutes in the past — this prevents replay attacks. CompareMath.abs(Date.now() / 1000 - Number(parts.t)) > 300.

Tenant-bound MCP tools for agent spend authorization, evidence, receipts, and settlement in Cursor, Codex, and Claude Code.

The DataFast MCP server lets MCP-compatible clients such as Codex, Claude Code, and Cursor query your analytics and manage your account through natural language.

Inkrun's remote MCP server lets AI agents like Claude turn Markdown into themed, consistent and reproducible on-brand PDFs with a single tool call

Transform your scattered documentation into AI-ready knowledge that works seamlessly with Claude, Cursor, VS Code, and other AI tools.

Autofill PDF is an MCP server that connects your Instafill.ai workspace to the Claude and ChatGPT MCP clients, allowing users to upload, search, and automatically fill PDF forms directly from chat.

Share your team's Coding Best Practices with Cursor, VS Code, Claude code, Windsurf, JetBrains IDEs and other coding tools supporting remote MCP connection.

A local MCP server that gives Claude Code, Cursor and Codex read access to your DynamoDB schema and items, with every write staged for human review.

Lance is an agent that runs on its own cloud Mac and handles everything on the App Store Connect side of shipping an iOS app. It connects to coding agents like Claude Code and Codex through MCP and takes over the parts they can't do: creating apps on App Store Connect, setting up notifications / widgets, filling out listing metadata, uploading builds to TestFlight, submitting for review, and responding to App Review feedback. Because it has its own Mac, it can also build, run, and test users' apps and capture screenshots.