# ShopDB MCP server (read-only)

Lets an LLM client query ShopDB directly as tools, generated from the OpenAPI
spec (`docs/openapi.json`). Separate from the app - runs anywhere that can reach
the API; never on the air-gapped prod box.

## Install + run
```
pip install -r mcp/requirements.txt
export SHOPDB_BASE="https://tsgwp00525.wjs.geaerospace.net/shopdb"
export SHOPDB_TOKEN="<scoped READ PAT>"     # mint in ShopDB: Settings > API Tokens
python mcp/shopdb_mcp.py                      # stdio
```
(Or `SHOPDB_API_KEY` instead of a Bearer PAT for managed-token access.)

## Claude Desktop
Add to `claude_desktop_config.json`:
```json
{
  "mcpServers": {
    "shopdb": {
      "command": "python",
      "args": ["/abs/path/shopdb-flask/mcp/shopdb_mcp.py"],
      "env": {
        "SHOPDB_BASE": "https://tsgwp00525.wjs.geaerospace.net/shopdb",
        "SHOPDB_TOKEN": "<scoped read PAT>"
      }
    }
  }
}
```

## Scope / safety
- **Read-only**: only GET endpoints on the curated allowlist (`CURATED` in
  `shopdb_mcp.py`) become tools; all writes are excluded.
- Give the PAT the **least** scope needed. Tool calls hit the normal API, so
  they're subject to its auth + land in the audit log.
- To add write tools later, extend `CURATED` / add `RouteMap`s for those verbs,
  behind a token that actually holds the scopes.

## Keeping it current
Tools follow `docs/openapi.json`. After API changes: `python scripts/gen_openapi.py`.