# epic-gog-free-games-mcp

A tiny, **read-only** [Model Context Protocol](https://modelcontextprotocol.io) server that reports
**free games on the Epic Games Store and GOG.com**. No account, no credentials, no local filesystem
access, no writes — it only calls public store endpoints.

Built for the lab's [obot](https://obot.ai) instance because no maintained, self-hostable Epic/GOG
MCP exists (the commonly-cited `pixfishx/mcp-epic-free-games` was removed from GitHub and PyPI).

## Tools

| Tool | What it returns |
|---|---|
| `epic_free_games_current` | Games **free to claim right now** on the Epic Games Store (title, normal price, store URL, claim window, image). |
| `epic_free_games_upcoming` | The **next** Epic free games (with the date each becomes free). Unrevealed "Mystery Game" slots are returned with a `null` URL. |
| `gog_giveaway` | The current **GOG giveaway** (limited-time claim-and-keep), or `{active:false}` when none is running. |
| `gog_free_games` | Free / free-to-play titles from the **GOG catalog** (price = 0). These are *permanently* free / F2P, not giveaways. Demos excluded by default. |

All tools take only optional args (`country`, `limit`, `excludeDemos`, `countryCode`,
`currencyCode`). Nothing is required; the server installs and runs unconfigured.

## Data sources (all public, unauthenticated)

- Epic: `store-site-backend-static.ak.epicgames.com/freeGamesPromotions`
- GOG giveaway: `www.gog.com/giveaway/api/get` (404 = no active giveaway)
- GOG catalog: `catalog.gog.com/v1/catalog?price=between:0,0`

## Run it

Requires Node.js 20+ (uses global `fetch`).

```bash
npx github:OnTarget600/epic-gog-free-games-mcp     # stdio MCP server
# or, from a clone:
npm install && npm start
npm run selftest                                   # hit the live endpoints, print results
```

### MCP client config (stdio)

```json
{
  "mcpServers": {
    "epic-gog-free-games": {
      "command": "npx",
      "args": ["github:OnTarget600/epic-gog-free-games-mcp#v0.1.0"]
    }
  }
}
```

## Security notes

- **Read-only.** No tool mutates anything; there is no auth and no secret to leak.
- **Egress only** to the three hosts above. No telemetry.
- Store **review/description text is third-party content** — treat tool output as untrusted data,
  not instructions (standard prompt-injection hygiene).
- Pin to a tag/commit (e.g. `#v0.1.0`) so a future push can't change behaviour silently.

## License

MIT