valorant-mcp

An always-available, private MCP server that gives its owner’s LLM client factual VALORANT account and match data through HenrikDev’s API.

• OAuth 2.1-authenticated, multi-user MCP server (Streamable HTTP)

• Invite-based consent model — no player is ever looked up without explicit consent

• Per-user-scoped Postgres cache, fail-open by design

• Strict TypeScript, zod-validated boundaries, 100+ tests

Quick start

The project targets Node.js 24.x and pnpm 10.x. See ARCHITECTURE.md for its current design.

pnpm install
pnpm dev

Related MCP server: Valorant MCP Server

Verify

sh scripts/check-agent-docs.sh

Normal use

Any OAuth-authenticated, consented user can request VALORANT data through the MCP endpoint. Most tools can target a consented friend's profile; see ARCHITECTURE.md for scope and tool details.

Onboarding a new user

Access is invite-only. To invite someone, call the admin endpoint with their Riot ID (name#tag):

curl -X POST https://valorant-mcp.vercel.app/api/admin/invite \
  -H "Authorization: Bearer <ADMIN_API_KEY>" \
  -H "Content-Type: application/json" \
  -d '{"name": "friend", "tag": "1234"}'

This resolves the Riot ID via HenrikDev, adds them to consented_profiles, and mints a one-time invite code. Send the returned claim_url to the invitee. They sign in via Supabase email OTP or magic link, and their email becomes their mcp_users row. Their MCP client endpoint is https://valorant-mcp.vercel.app/api/mcp. Keep ADMIN_API_KEY in Vercel's Preview/Production env vars or the owner's local .env; never commit or share it.

Email OTP setup

The login page supports entering a one-time code in the same browser that started OAuth. In the Supabase dashboard, change the Magic Link email template to use {{ .Token }} instead of {{ .ConfirmationURL }}; Supabase sends a link when the template contains {{ .ConfirmationURL }}. The existing callback still supports magic links opened in the browser that initiated sign-in; entering the code avoids cross-browser PKCE failures.

License

MIT