# MCP1

Remote MCP server delivering the Doggi (Careful Starter) investor-psychology curriculum as 7 tools. Built so Claude pulls only the lesson slice it needs per turn instead of re-ingesting the whole corpus.

## Layout

| Path | What |
|---|---|
| `server.py` | Business logic. The `DoggiMCP` class — 7 tool handlers, reads from disk |
| `http_server.py` | HTTP wrapper. Exposes `DoggiMCP` over MCP Streamable HTTP, with API-key auth |
| `coaching_session.py` | Local client (Anthropic SDK). Useful for testing tool flow without deploying |
| `tests/demo.py` | Smoke test, runs every tool |
| `data/` | Framework, archetype, interventions, progress (source of truth) |
| `lessons/` | Lesson 1–6 markdown (source of truth) |
| `Dockerfile`, `fly.toml`, `requirements.txt` | Deploy config for Fly.io |
| `DEPLOY.md` | Step-by-step deploy guide |

## Run locally

```bash
# Smoke test, no API key needed
python3 tests/demo.py

# Run the HTTP server locally
MCP_API_KEY=test pip install -r requirements.txt
MCP_API_KEY=test python3 http_server.py
curl -H "X-API-Key: test" http://localhost:8000/mcp

# Live coaching client (needs ANTHROPIC_API_KEY + COACHING_MODEL)
python3 coaching_session.py
```

## Deploy

See **DEPLOY.md** — Fly.io, ~20 minutes end to end.

## Tools

1. `get_lesson(n)` — lesson 1–6
2. `get_framework()` — north star
3. `get_archetype_triggers()` — Doggi triggers, red flags, strengths
4. `get_coaching_intervention(n)` — coaching style, do/don't, example for lesson n
5. `get_progress_state()` — where the client is in the journey
6. `analyze_response(text, n)` — match user text against triggers and red flags
7. `next_lesson(n)` — sequencing

## Customize

Everything lives in `data/` and `lessons/`. Edit, commit, `fly deploy`. No code change needed.

- `lessons/lesson{1-6}.md` — lesson content
- `data/archetype.json` — triggers, red flags, strengths
- `data/interventions.json` — coaching style per lesson
- `data/progress_state.json` — client state (replace with DB query in production)

## Design notes

- **Don't put this README (or other docs) into the Claude Project space.** Anything Claude reads on every turn defeats the MCP's purpose.
- **Don't hard-code dated model IDs.** `coaching_session.py` reads `COACHING_MODEL` from env.
- **Source of truth is on disk, not in code.** No embedded copies.
- **Tool descriptions are intentionally short** (≤6 words). The schemas describe inputs.
- **API key auth is mandatory.** `http_server.py` refuses to start without `MCP_API_KEY`.

## Security

- API key required on all `/mcp` requests via `X-API-Key` header
- `/health` is open (Fly.io needs it for liveness checks)
- Path traversal blocked: `lesson_num` validated as int 1–6 before any file access
- Input size capped: `analyze_response` rejects payloads over 10KB
- Container runs as non-root user
- No secrets in source — `MCP_API_KEY` and `ANTHROPIC_API_KEY` come from env only
- `.gitignore` and `.dockerignore` exclude `.env*` and other secret patterns