# zee5-mcp-private — Subscriber Personalization MCP (FastMCP, Cloud Run)

Self-hosted **subscriber-data** MCP server for the Stream Discovery ADK agent.
Streamable-HTTP MCP (FastMCP 3.x), stateless, mounts at `/mcp`. All data is
**synthetic** (invented subscribers — no real PII).

> "Private" describes the **data domain** (subscriber profiles/billing), not the
> network. In this POC it is deployed **public** on Cloud Run; the Agent Gateway
> governs which agent identities may reach it.

Tools: `get_profile`, `get_watch_history`, `get_continue_watching`,
`get_taste_profile`, `get_entitlements`, `get_ratings`, `get_subscription`,
`get_billing`, `get_transactions`, `get_plans`.

## Deploy to Cloud Run (public, unauthenticated) — Singapore

```bash
export PROJECT_ID="gm-test-337806"
export REGION="asia-southeast1"

gcloud config set project "$PROJECT_ID"
gcloud services enable run.googleapis.com cloudbuild.googleapis.com artifactregistry.googleapis.com

git clone https://github.com/<you>/zee5-mcp-private.git && cd zee5-mcp-private

gcloud run deploy zee5-subscriber-mcp \
  --source . \
  --region="$REGION" \
  --allow-unauthenticated \
  --min-instances=1 \
  --timeout=3600 \
  --no-cpu-throttling \
  --project="$PROJECT_ID"

gcloud run services describe zee5-subscriber-mcp --region="$REGION" \
  --project="$PROJECT_ID" --format='value(status.url)'
```

> **If `--allow-unauthenticated` fails** (org Domain-Restricted-Sharing), use
> `--no-invoker-iam-check` instead.

## Smoke test

```bash
URL=$(gcloud run services describe zee5-subscriber-mcp --region="$REGION" --format='value(status.url)')
curl -s "$URL/mcp" -H 'content-type: application/json' \
  -H 'accept: application/json, text/event-stream' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' | head -c 600
# then a real call (sample synthetic subscriber):
curl -s "$URL/mcp" -H 'content-type: application/json' \
  -H 'accept: application/json, text/event-stream' \
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"get_profile","arguments":{"subscriber_id":"SUB-IN-100023"}}}' | head -c 600
```

## Local run

```bash
pip install -r requirements.txt
PORT=8082 python server.py    # http://127.0.0.1:8082/mcp
```