# bp-mcp-idd

A **read-only Model Context Protocol (MCP) server for [BigPicture](https://bigpicture.one)**.

It lets technical enterprise users query live BigPicture portfolio data — projects, timelines,
resources, risk and boards — from any MCP-compatible AI client, and puts **a source citation on every
answer**, so a number in a chat window can be traced back to the endpoint and box it came from.

## Status

Nothing is built yet. This commit exists so the repository has a `HEAD`.

The code in this repository is written by sandboxed agents driven by
[isolated-claude](https://github.com/pater-appfire/isolated-claude), following an
intent-driven-development workflow. Each run clones this repository into a hardened container, works,
and is harvested as a patch.

## Scope

Read-only. The server never writes to BigPicture — no endpoint that mutates state is exposed as a
tool, and that is a property to be tested, not a convention.

| area | what a client should be able to ask |
| --- | --- |
| Portfolio structure | the box hierarchy, box types, what contains what |
| Timelines | task dates and ranges within a box |
| Resources | teams, members, allocations, capacity, absences, skills |
| Risk | the risk register for a box |
| Boards | board configuration and contents |
| Objectives | OKRs — objectives, key results, updates |

## Authorization

The BigPicture public API takes a token in an `Authorization: Bearer <token>` header. Tokens are
created and revoked in the BigPicture UI. The API index used to build this server is published at
<https://developer.bigpicture.one/llms.txt>; endpoints live under paths such as
`/public/ppm/box/box-hierarchy`.

A token is a credential. It is read from the environment, never committed, and never echoed into a
tool result.