# Logiwa WMS MCP Server — Read-Only Access for Claude and ChatGPT

This project is a read-only adaptation of [Logiwa IO WMS MCP by cgtykctn](https://github.com/cgtykctn/Logiwa-IO-WMS--MCP-). It builds on the original TypeScript server and Logiwa API integration, adding remote access over Streamable HTTP, Auth0 authorization, and Vercel deployment. The original public Git history and [Apache 2.0 license](LICENSE) are preserved.

The server exposes 18 read-only tools for products, inventory, orders, returns, warehouses, business partners, reports, and reference lookups. Each organization deploys its own instance with its own Auth0 tenant and Logiwa API token. Auth0 controls who can connect, and the server uses the organization's Logiwa token for data requests.

## Deploy to Vercel with Auth0

You need a Vercel account, access to an Auth0 tenant, and a Logiwa API token for the data you want to query.

1. **Import into Vercel.** Import this GitHub repository as a project and select Node.js 24.x. The repository provides the build settings. Choose a stable production hostname and use its HTTPS URL ending in `/api/mcp` as the MCP endpoint. The connector must be able to reach that hostname, so use the production domain without a Vercel sign-in wall.
2. **Configure Auth0.** Create an RS256 API with the exact MCP endpoint as its Identifier, with no trailing slash. Enable RBAC, **Add Permissions in the Access Token**, and **Allow Offline Access**. Enable **Resource Parameter Compatibility Profile** in the tenant's Advanced settings. Create the API permission `read:logiwa`, add it to a role such as `Logiwa Reader`, and assign that role to authorized users. For each connector you intend to use, register a public Native app with Authorization Code, PKCE (S256), Refresh Token, and token endpoint authentication set to **None**. Under API access policies, grant each app user-delegated access to `read:logiwa` and deny machine-to-machine access. Enable an appropriate user connection on each app and disable public sign-ups if using a private database connection. Use the callbacks below. [Auth0 RBAC](https://auth0.com/docs/get-started/apis/enable-role-based-access-control-for-apis) · [Resource parameter setup](https://support.auth0.com/center/s/article/mcp-audience-error-with-auth0)
3. **Set production variables and deploy.** Set `AUTH0_ISSUER_URL` to your Auth0 issuer (for example, `https://YOUR-TENANT.us.auth0.com/`) and `MCP_RESOURCE_URL` to the exact MCP endpoint. Store `LOGIWA_API_TOKEN` as a production secret with the raw token value, without the `Bearer` prefix. Deploy or redeploy. [Environment example](.env.example)
4. **Connect and test.** Add the custom connector with the MCP endpoint and the corresponding Auth0 Client ID. Leave the client secret blank. Sign in as an authorized user and ask the connector to show the first page of Logiwa inventory.

| Client | Connector settings | Auth0 callback |
| --- | --- | --- |
| [Claude](https://claude.com/docs/connectors/building/authentication) | **Sign in now** → **Use your own OAuth client**. Use Streamable HTTP. | `https://claude.ai/api/mcp/auth_callback` |
| [ChatGPT](https://developers.openai.com/plugins/build/auth) | **OAuth** → **User-Defined OAuth Client**. Use token endpoint authentication **None**, data scope `read:logiwa`, and base scopes `openid profile email offline_access`. | Copy the exact redirect URI shown in the connector settings. When the stable callback is available, it is `https://chatgpt.com/connector_platform_oauth_redirect`. |

## Maintenance

- **Grant or remove access** by assigning or removing the Auth0 role. Set a short API access-token lifetime, such as 900 seconds, because previously issued tokens remain valid until they expire.
- **Rotate the Logiwa token** by updating the Vercel production secret and redeploying.
- **Troubleshoot** by checking `/api/health` for liveness. A `401` from `/api/mcp` without a token is expected. A `403` after sign-in can mean the token lacks the required scope or permission. Check the user's role and reconnect.

Run `npm ci --ignore-scripts` and `npm test` to build and verify the project locally.