# OAPT — Claude Desktop Extension (`.mcpb`)

Connects **Claude Desktop** to the hosted **OAPT** MCP (Orion Agentic Partnerships Team):
`ask_oapt` natural-language questions across Dynamics CRM, AWS ACE / Partner Central, Microsoft
Partner Center, account dossiers and institutional memory — plus account briefs, pipeline health,
ACE status, and readiness — all from inside Claude Desktop.

Each user authenticates with **their own OAPT API key**, entered once on install and stored in the
OS keychain. The extension ships **no key**.

## Why an extension (`.mcpb`) and not a marketplace plugin

OAPT is a *remote* (hosted) MCP, and each user needs their own key. Claude Desktop's plugin
marketplace can't prompt for a per-user secret — only a Desktop **Extension** (`.mcpb`) can (the
`sensitive` config field). A `.mcpb` can only launch a *local* process, so this one carries a tiny
zero-dependency `server/bridge.js` that forwards Claude's MCP messages to the hosted OAPT endpoint
over HTTPS, injecting your key as the `x-api-key` header. You never see the bridge — you paste a key
and OAPT's tools appear.

## Install (one time)

1. Get your OAPT API key (starts with `oapt_`) from David or the OAPT settings page.
2. Open **Claude Desktop → Settings → Extensions**.
3. Drag **`oapt-mcp.mcpb`** onto the window (or **Install Extension…** → pick the file).
4. When prompted for **OAPT API Key**, paste your key. (Leave **OAPT Server URL** at its default.)
5. Done. Start a chat and ask, e.g., *"ask OAPT for the account dossier on Fiserv."* You should see
   `ask_oapt`, `get_account_dossier`, `search_ace`, and the rest.

## Updating

**Most changes need no action from you.** OAPT's tools and behavior live on the hosted server — when
we ship a new tool or a fix, your Claude Desktop picks it up automatically on the next call. There is
nothing to reinstall.

You only need a new `.mcpb` if the **connection itself** changes (the endpoint URL, or the bridge).
In that case: download the new `oapt-mcp.mcpb`, drag it onto **Settings → Extensions**, and it
replaces the old one (your saved key carries over).

## For maintainers — build & release

```bash
# from this directory
npx @anthropic-ai/mcpb@latest validate manifest.json   # schema check
npx @anthropic-ai/mcpb@latest pack . oapt-mcp.mcpb      # produce the .mcpb

# smoke-test the bridge end-to-end (dummy key → server auth-rejection forwarded cleanly):
OAPT_API_KEY=oapt_dummy node -e 'const{spawn}=require("child_process");const c=spawn(process.execPath,["server/bridge.js"]);c.stdout.pipe(process.stdout);c.stdin.write(JSON.stringify({jsonrpc:"2.0",id:1,method:"initialize",params:{}})+"\n");setTimeout(()=>c.kill(),4000)'
```

Distribute by attaching `oapt-mcp.mcpb` to a **GitHub Release** (or hosting it on the OAPT site) and
sending users the download link. Bump `version` in `manifest.json` for connection-config changes.

## What's in the box

| File | Purpose |
|------|---------|
| `manifest.json` | Extension manifest — declares the local bridge + the `sensitive` API-key prompt |
| `server/bridge.js` | Zero-dependency stdio↔HTTPS proxy to the hosted OAPT MCP (injects `x-api-key`) |
| `package.json` | Marks the bridge as CommonJS; no runtime dependencies |