MCP1

Remote MCP server delivering the Doggi (Careful Starter) investor-psychology curriculum as 7 tools. Built so Claude pulls only the lesson slice it needs per turn instead of re-ingesting the whole corpus.

Layout

Related MCP server: fallscout-mcp

Run locally

# Smoke test, no API key needed
python3 tests/demo.py

# Run the HTTP server locally
MCP_API_KEY=test pip install -r requirements.txt
MCP_API_KEY=test python3 http_server.py
curl -H "X-API-Key: test" http://localhost:8000/mcp

# Live coaching client (needs ANTHROPIC_API_KEY + COACHING_MODEL)
python3 coaching_session.py

Deploy

See DEPLOY.md — Fly.io, ~20 minutes end to end.

Tools

1. get_lesson(n) — lesson 1–6

2. get_framework() — north star

3. get_archetype_triggers() — Doggi triggers, red flags, strengths

4. get_coaching_intervention(n) — coaching style, do/don't, example for lesson n

5. get_progress_state() — where the client is in the journey

6. analyze_response(text, n) — match user text against triggers and red flags

7. next_lesson(n) — sequencing

Customize

Everything lives in data/ and lessons/. Edit, commit, fly deploy. No code change needed.

• lessons/lesson{1-6}.md — lesson content

• data/archetype.json — triggers, red flags, strengths

• data/interventions.json — coaching style per lesson

• data/progress_state.json — client state (replace with DB query in production)

Design notes

• Don't put this README (or other docs) into the Claude Project space. Anything Claude reads on every turn defeats the MCP's purpose.

• Don't hard-code dated model IDs. coaching_session.py reads COACHING_MODEL from env.

• Source of truth is on disk, not in code. No embedded copies.

• Tool descriptions are intentionally short (≤6 words). The schemas describe inputs.

• API key auth is mandatory. http_server.py refuses to start without MCP_API_KEY.

Security

• API key required on all /mcp requests via X-API-Key header

• /health is open (Fly.io needs it for liveness checks)

• Path traversal blocked: lesson_num validated as int 1–6 before any file access

• Input size capped: analyze_response rejects payloads over 10KB

• Container runs as non-root user

• No secrets in source — MCP_API_KEY and ANTHROPIC_API_KEY come from env only

• .gitignore and .dockerignore exclude .env* and other secret patterns