Tough Customer MCP

Remote MCP server (Next.js on Vercel) that exposes the Tough Customer roleplay setup workflow to LLM clients (Claude, ChatGPT, MCP Inspector).

Auth model: Model B — Supabase Auth is the OAuth Authorization Server. Claude carries a Supabase-issued JWT, never a raw Salesforce token. Salesforce is a downstream backend; users link it once at /connect, and the MCP server stores an envelope-encrypted refresh token and mints short-lived SF access tokens per request. SOQL runs WITH USER_MODE, so Salesforce enforces FLS + sharing as the linked end user.

See userstories.md (especially §2.1, §2.2, §2.7) for the full architecture and security rationale.

Endpoints

Tools exposed

• list_opportunities

• list_voices

• list_scenarios

• get_opportunity_contacts

• create_roleplay_session

• Prompt: setup_sales_roleplay

Local development

npm install
cp .env.example .env.local   # fill in the values
npm run dev
# http://localhost:3000
# MCP endpoint: http://localhost:3000/mcp

For local dev without Supabase / Salesforce, set TC_MODE=mock — the server serves in-memory data and skips auth.

Inspect with the MCP Inspector:

npx @modelcontextprotocol/inspector
# Transport: Streamable HTTP
# URL: http://localhost:3000/mcp

Deploy to Vercel

gh repo create mcp --public --source=. --remote=origin --push
npx vercel link
npx vercel --prod

Provision Supabase via the Vercel Marketplace integration so NEXT_PUBLIC_SUPABASE_URL, NEXT_PUBLIC_SUPABASE_ANON_KEY, and SUPABASE_SERVICE_ROLE_KEY are auto-populated across all environments.

Apply database migrations:

supabase db push

Custom domains (production):

• mcp.toughcustomer.ai → this Vercel project

• app.toughcustomer.ai → this Vercel project (alias; serves /connect)

• auth.toughcustomer.ai → Supabase (custom hostname; see docs/CUSTOM_DOMAIN.md)

Salesforce setup

The Connected App is a downstream backend, not the AS for Claude. See docs/SALESFORCE_SETUP.md for the Connected App runbook and docs/SALESFORCE_OBJECTS.md for the custom objects + fields the SF admin must create. No Apex deploy required — the MCP server uses SF REST GraphQL exclusively, which enforces FLS + sharing for all profiles including admins.

Vault graduation

v1 encrypts SF refresh tokens with AES-256-GCM keyed by the VAULT_KEY_V1 env var. Before any non-internal customer connects real Salesforce data, graduate to Supabase Vault or external KMS — see docs/VAULT_V2.md.