shopdb-flask/mcp

ShopDB MCP server (read-only)

Lets an LLM client query ShopDB directly as tools, generated from the OpenAPI spec (docs/openapi.json). Separate from the app - runs anywhere that can reach the API; never on the air-gapped prod box.

Install + run

pip install -r mcp/requirements.txt
export SHOPDB_BASE="https://tsgwp00525.wjs.geaerospace.net/shopdb"
export SHOPDB_TOKEN="<scoped READ PAT>"     # mint in ShopDB: Settings > API Tokens
python mcp/shopdb_mcp.py                      # stdio

(Or SHOPDB_API_KEY instead of a Bearer PAT for managed-token access.)

Claude Desktop

Add to claude_desktop_config.json:

{
  "mcpServers": {
    "shopdb": {
      "command": "python",
      "args": ["/abs/path/shopdb-flask/mcp/shopdb_mcp.py"],
      "env": {
        "SHOPDB_BASE": "https://tsgwp00525.wjs.geaerospace.net/shopdb",
        "SHOPDB_TOKEN": "<scoped read PAT>"
      }
    }
  }
}

Scope / safety

• Read-only: only GET endpoints on the curated allowlist (CURATED in shopdb_mcp.py) become tools; all writes are excluded.
• Give the PAT the least scope needed. Tool calls hit the normal API, so they're subject to its auth + land in the audit log.
• To add write tools later, extend CURATED / add RouteMaps for those verbs, behind a token that actually holds the scopes.

Keeping it current

Tools follow docs/openapi.json. After API changes: python scripts/gen_openapi.py.