# webget-mcp

An MCP (Model Context Protocol) server that lets an MCP client (e.g. Claude
Desktop) run read-only SQL queries against Increff Webget's database
replicas, by reusing an authenticated browser session instead of requiring
separate DB credentials.

## Tools

- **`webget_list_databases`** — lists the database server names available in
  Webget's SQL Query Editor (the same dropdown as
  `https://saas.increff.com/webget/in/sql`). Uses a bundled snapshot by
  default; pass `refresh: true` to re-scrape the live dropdown (needed right
  after a fresh install, since the bundled snapshot starts empty, or to pick
  up newly added servers).
- **`webget_run_query`** — runs a single read-only SQL statement (`SELECT`,
  `SHOW`, `EXPLAIN`, `DESCRIBE`) against a given database server and returns
  the result as rows/columns. Statements containing write/DDL keywords
  (`INSERT`, `UPDATE`, `DELETE`, `DROP`, `ALTER`, `TRUNCATE`, `CREATE`,
  `GRANT`, `REVOKE`, `REPLACE`, `MERGE`) are rejected before they ever reach
  webget.

### Query confirmation

Every query is shown to a human and requires explicit approval before it
runs. The server tries MCP elicitation first (an in-chat confirmation
prompt); if the connected client doesn't support that method, it falls back
to a native macOS confirmation dialog (`osascript display dialog`) shown
directly on the machine running the server. This is enforced server-side on
every single call and does not depend on — and cannot be bypassed by — any
client-side "always allow" setting.

## Requirements

- Node.js 20+ (an old `node` picked up from PATH, e.g. via a stale nvm
  shim, will fail to run the built ES2022/top-level-await output — point
  your MCP client config at an absolute path to a Node 20+ binary)
- macOS (the confirmation-dialog fallback shells out to `osascript`)
- A Webget/Increff SSO account

## Setup

```bash
npm install
npm run build
```

### One-time login

```bash
npm run login
```

This opens a real, visible Chromium window pointed at webget. Complete your
company SSO login there. The session is saved to a local persistent browser
profile at `~/.webget-mcp/` and reused by the MCP server for all future
queries — you should only need to do this again after your session expires.

If the automated login gets blocked by bot detection, you can instead import
an already-logged-in session's cookies directly from Chrome DevTools:

```bash
# DevTools -> Network tab -> pick a request to the target domain -> Headers
# -> Request Headers -> copy the full "cookie:" value
node dist/import-cookies.js saas.increff.com "<cookie header value>"
node dist/import-cookies.js account.increff.com "<cookie header value>"
```

Run once per domain; each run merges into the same stored session state.

### Connect it to your MCP client

For Claude Desktop, add to `claude_desktop_config.json`:

```json
{
  "mcpServers": {
    "webget": {
      "command": "/absolute/path/to/node",
      "args": ["/absolute/path/to/webget-mcp/dist/index.js"]
    }
  }
}
```

Use an absolute path for both `command` and `args` — Claude Desktop's
default PATH resolution can pick up an unexpected Node version, and relative
paths won't resolve correctly. After editing the config, fully quit and
reopen Claude Desktop (a running instance can silently overwrite external
edits to this file with its own in-memory copy).

## Notes

- Session/login state lives outside the repo at `~/.webget-mcp/` — it is
  never part of this project and should never be committed.
- Results are limited only by webget's own API limits (roughly 1 MB /
  10,000 rows per request). For larger exports, page through with
  `ORDER BY <key> LIMIT n OFFSET m` across multiple calls.
- Only read-only statements are accepted; there is no way to run write or
  schema-changing SQL through this server.