Skip to main content
Glama
benoib

ROAST MCP App

by benoib
OverviewSchemaSourceRelated ServersDiscussionsAdmin
TypeScript
Remote

ROAST MCP App

Skybridge MCP / ChatGPT app for authenticated ROAST users.

The app exposes a protected /mcp endpoint, maps the OAuth identity to a ROAST user_firebase_id, and calls the existing ROAST backend with a server-side backend bearer token. Tool inputs never accept user_firebase_id; user scope is always derived from auth.

Current Tools

  • show_roast_dashboard: dashboard view with account summary, recent profiles, photoshoots, and images.

  • list_my_profiles: recent profile reviews for the authenticated user.

  • list_my_photoshoots: recent photoshoots for the authenticated user.

  • list_my_images: recent visible images for the authenticated user.

Related MCP server: AuroraDocs MCP Server

Setup

Requires Node.js 24+.

npm install
cp .env.example .env
npm run dev

Skybridge runs the MCP endpoint at http://localhost:3000/mcp and DevTools at http://localhost:3000.

Auth Modes

Production: Firebase OAuth Bridge

Use ROAST_MCP_AUTH_MODE=firebase.

The MCP app exposes OAuth-compatible endpoints for ChatGPT/MCP clients:

  • GET/POST /oauth/authorize

  • POST /oauth/token

  • POST /oauth/register

The authorization page signs users into Firebase with their ROAST email and password, then issues an MCP bearer token whose subject is the Firebase UID. That UID is used directly as ROAST user_firebase_id, so paid users keep access to their subscription, coins, products, and photoshoots.

Required variables:

ROAST_MCP_AUTH_MODE=firebase
FIREBASE_WEB_API_KEY=...
MCP_AUTH_JWT_SECRET=...
ROAST_API_BEARER_TOKEN=...

Optional: Auth0

Use ROAST_MCP_AUTH_MODE=auth0 if you want to fall back to Auth0. The access token is verified against Auth0 JWKS, then mapped to ROAST by ROAST_USER_ID_CLAIM or verified email lookup.

Local: Dev Token

Use ROAST_MCP_AUTH_MODE=dev with:

ROAST_MCP_DEV_TOKEN=dev-roast-token
ROAST_MCP_DEV_USER_FIREBASE_ID=<existing-roast-user-firebase-id>

Then connect with:

Authorization: Bearer dev-roast-token

Environment

See .env.example.

Important variables:

  • SERVER_URL: public Skybridge server URL.

  • APP_DOMAIN: public domain for rendered views.

  • ROAST_API_BASE_URL: ROAST backend API base URL.

  • ROAST_API_BEARER_TOKEN: backend-to-backend token accepted by ROAST.

  • AUTH0_DOMAIN: Auth0 tenant domain.

  • AUTH0_AUDIENCE: Auth0 API audience used for MCP access tokens.

Verify

npm run build

This server cannot be deployed

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Maintenance

ActivitySlowing
ResponsivenessNo issues

Resources

Related MCP Connectors

Related MCP Servers

  • Firebase DAM MCP Server

    lt012071
    A
    license
    Not graded
    quality
    D
    maintenance
    Enables secure, read-only access to Firebase Firestore collections and Storage buckets for Digital Asset Management systems. It allows users to query assets, versions, and comments, and search storage files using flexible filters through standard MCP tools.
    MIT

  • Productboard MCP — Curve &

    lukeanderson-code
    F
    license
    Not graded
    quality
    B
    maintenance
    Enables reading and writing Productboard data via MCP tools, with Google OAuth login, per-user allowlist, and workspace binding for secure, audited access.
    -

  • Kuroko MCP Server

    nguyenthdat
    A
    license
    Not graded
    quality
    B
    maintenance
    Enables security agents to interact with the Kuroko web security testing platform through MCP, providing access to traffic history, site graph entities, findings, and scan jobs with read-only defaults and scoped, approved tools for testing operations.
    1
    Apache 2.0