# honcho-mcp-web

Remote MCP server (HTTP/OAuth) exposing a self-hosted Honcho instance to
`claude.ai` custom connectors and other MCP clients (Codex, Copilot, etc).

Two pieces run in the same container:

- `vendor/honcho-mcp` (git submodule, upstream: [devstroop/honcho-mcp](https://github.com/devstroop/honcho-mcp))
  — the actual MCP tool implementations (peers, sessions, conclusions,
  workspace, dream/queue). Runs on `localhost:3000`, not exposed outside
  the container.
- `src/` (this repo) — a minimal single-user OAuth 2.1 (PKCE + Dynamic
  Client Registration) authorization server plus a token admin panel
  (`/admin`, HTTP Basic Auth), sitting in front of the upstream and
  proxying only authenticated requests to it. Each issued token
  (OAuth-issued for claude.ai, or a static token minted from `/admin` for
  CLI-style clients) is bound to an identity (`workspace` / `peer` /
  `ai_peer`) that the gateway enforces server-side on every `tools/call`.

## Env vars

| Variable | Default | Description |
| --- | --- | --- |
| `HONCHO_API_URL` | `http://api:8000` | Self-hosted Honcho backend URL (passed to the upstream submodule) |
| `HONCHO_API_KEY` | — | API key for the Honcho backend |
| `HONCHO_WORKSPACE_ID` | `default` | Workspace the upstream operates in |
| `PUBLIC_URL` | `http://localhost:8802` | Public URL of this gateway (used in OAuth metadata) |
| `GATEWAY_PASSWORD` | — | Password for `/authorize` consent and `/admin` Basic Auth |
| `HONCHO_PEER` | `leandro-sampaio` | Default human peer shown in token forms |
| `PORT` | `8802` | Gateway listen port |

## Updating the upstream

```bash
git submodule update --remote vendor/honcho-mcp
git add vendor/honcho-mcp
git commit -m "Atualiza devstroop/honcho-mcp"
```