# ROAST MCP App

Skybridge MCP / ChatGPT app for authenticated ROAST users.

The app exposes a protected `/mcp` endpoint, maps the OAuth identity to a ROAST
`user_firebase_id`, and calls the existing ROAST backend with a server-side
backend bearer token. Tool inputs never accept `user_firebase_id`; user scope is
always derived from auth.

## Current Tools

- `show_roast_dashboard`: dashboard view with account summary, recent profiles,
  photoshoots, and images.
- `list_my_profiles`: recent profile reviews for the authenticated user.
- `list_my_photoshoots`: recent photoshoots for the authenticated user.
- `list_my_images`: recent visible images for the authenticated user.

## Setup

Requires Node.js 24+.

```bash
npm install
cp .env.example .env
npm run dev
```

Skybridge runs the MCP endpoint at `http://localhost:3000/mcp` and DevTools at
`http://localhost:3000`.

## Auth Modes

### Production: Firebase OAuth Bridge

Use `ROAST_MCP_AUTH_MODE=firebase`.

The MCP app exposes OAuth-compatible endpoints for ChatGPT/MCP clients:

- `GET/POST /oauth/authorize`
- `POST /oauth/token`
- `POST /oauth/register`

The authorization page signs users into Firebase with their ROAST email and
password, then issues an MCP bearer token whose subject is the Firebase UID. That
UID is used directly as ROAST `user_firebase_id`, so paid users keep access to
their subscription, coins, products, and photoshoots.

Required variables:

```bash
ROAST_MCP_AUTH_MODE=firebase
FIREBASE_WEB_API_KEY=...
MCP_AUTH_JWT_SECRET=...
ROAST_API_BEARER_TOKEN=...
```

### Optional: Auth0

Use `ROAST_MCP_AUTH_MODE=auth0` if you want to fall back to Auth0. The access
token is verified against Auth0 JWKS, then mapped to ROAST by
`ROAST_USER_ID_CLAIM` or verified email lookup.

### Local: Dev Token

Use `ROAST_MCP_AUTH_MODE=dev` with:

```bash
ROAST_MCP_DEV_TOKEN=dev-roast-token
ROAST_MCP_DEV_USER_FIREBASE_ID=<existing-roast-user-firebase-id>
```

Then connect with:

```text
Authorization: Bearer dev-roast-token
```

## Environment

See `.env.example`.

Important variables:

- `SERVER_URL`: public Skybridge server URL.
- `APP_DOMAIN`: public domain for rendered views.
- `ROAST_API_BASE_URL`: ROAST backend API base URL.
- `ROAST_API_BEARER_TOKEN`: backend-to-backend token accepted by ROAST.
- `AUTH0_DOMAIN`: Auth0 tenant domain.
- `AUTH0_AUDIENCE`: Auth0 API audience used for MCP access tokens.

## Verify

```bash
npm run build
```