Precogly MCP

MCP server for Precogly threat modeling.

Status

Early. Four tools, all read-only:

• list_threat_models — threat models in the caller's organizations, most recently updated first, with total beside them. Mounted, that is everything the caller can read; over stdio it is one page of twenty, and total is how you tell the difference.

• search_threat_library, search_countermeasure_library, search_component_library — the shared catalogs installed packs populate, with matched and catalogSize beside the rows.

Both transports work end to end. A tool reads Precogly through a protocol the mounting application supplies rather than by forwarding the caller's token, which cannot work mounted: a token issued for the MCP endpoint is audience-bound and invalid at Precogly's REST API by construction (0008).

Two transports

Which one you run decides where the credential comes from, and nothing else. The tools, their schemas and their results are identical.

The mounted transport is the product (0008); stdio is what predates it and what the MCP specification prescribes for a server that speaks over a pipe.

Mounted

Precogly serves the endpoint from its own WSGI process at /mcp, and supplies a token verifier — this package never imports Django. config/mcp_mount.py in the Precogly repository is the whole of the wiring. A client then needs no configuration beyond the URL:

{
  "mcp": {
    "precogly": {
      "type": "remote",
      "url": "http://localhost:8000/mcp",
      "enabled": true
    }
  }
}

For opencode, that is an opencode.json — either in the project root or in ~/.config/opencode/, which makes the server reachable from any directory — followed by:

opencode mcp auth precogly     # discovery, registration, browser consent
opencode mcp list              # ✓ connected

The client discovers where to authorize from the 401 this endpoint returns, registers itself, and sends the user to Precogly's own login and consent screens (0004, 0009). Nothing is pasted anywhere.

Stdio

Two environment variables, both read by the server process:

Against a locally seeded instance, a token comes from the login endpoint:

export PRECOGLY_URL=http://localhost:8000
export PRECOGLY_TOKEN=$(curl -s -X POST "$PRECOGLY_URL/api/auth/login/" \
  -H 'Content-Type: application/json' \
  -d '{"email":"admin@precogly.dev","password":"admin123"}' \
  | python3 -c "import sys,json;print(json.load(sys.stdin)['access'])")

Either entry point runs it:

uv run precogly-mcp                  # console script
uv run python -m precogly_mcp.server # equivalent

Under the MCP Inspector, for poking at schemas by hand. --with-editable . is required — mcp dev runs the file in an ephemeral environment containing only mcp, so without it nothing in this package imports:

uv run mcp dev src/precogly_mcp/server.py --with-editable .

Development

This project uses uv for dependencies and tooling.

uv sync                    # create .venv and install deps + dev tools
uv run pytest              # run tests
uv run ruff check .        # lint
uv run ruff format .       # format
uv run mypy src            # type-check (strict)
uv run pip-audit           # scan dependencies for CVEs

Install the git hooks once:

uv run pre-commit install

Tests need no running Precogly. mcp.client.Client drives the server over in-memory streams, so tools/list and tools/call are exercised as a client sees them, and httpx2.MockTransport stands in for the API.

That transport is also their blind spot: every test passed against a version of tools/call that failed on the first real request, because the fake never enforced the audience binding a live token carries. A change to how tools reach data, or to what Precogly's serializers return, wants a run against a seeded stack before it is believed.

Design

• 0001 — service token model (partially superseded by 0003)

• 0002 — tool implementation order

• 0003 — Precogly is the authorization server (resource server superseded by 0008)

• 0004 — where the user authorizes

• 0005 — code execution over tools

• 0006 — catalog search filters here

• 0007 — re-authenticating at consent

• 0008 — the MCP server runs inside Precogly

• 0009 — the authorization pages are built, not copied

• 0010 — the MCP app owns its resource metadata