✨(mcp) add the docs-mcp server

Add `src/frontend/servers/mcp`, a stateless TypeScript (Express +
`@modelcontextprotocol/sdk`) MCP server exposing `search_documents`,
`read_document` and `create_document` over Streamable HTTP.

It is an OAuth resource server holding no credentials of its own: it
verifies the caller's Keycloak token against the realm JWKS
(`src/auth/jwtVerifier.ts`), checks the `docs-mcp` audience, then
forwards the same token unchanged to Django's
`/api/v1.0/mcp/documents/*` endpoints (`src/docsApiClient.ts`),
which stays the sole authority on document permissions.
No token exchange.

Ship the `mcp-development` compose service, its `env.d/development/mcp`
env file, a `build-mcp` Makefile helper, and
`documentation/mcp_server.md` describing the full flow and
how to connect MCP clients.
This commit is contained in:
Anthony LC
2026-09-25 12:07:58 +02:00
parent c3e82d9cac
commit e596b73bce
27 changed files with 1406 additions and 15 deletions
+8
View File
@@ -90,6 +90,7 @@ create-env-local-files:
@touch env.d/development/postgresql.local
@touch env.d/development/kc_auth.local
@touch env.d/development/kc_postgresql.local
@touch env.d/development/mcp.local
@touch env.d/development/yhub-postgres.local
@touch env.d/development/yhub.local
.PHONY: create-env-local-files
@@ -211,6 +212,7 @@ build: ## build the project containers
@$(MAKE) build-backend cache=$(cache)
@$(MAKE) build-yhub cache=$(cache)
@$(MAKE) build-yjs-provider cache=$(cache)
@$(MAKE) build-mcp cache=$(cache)
@$(MAKE) build-frontend cache=$(cache)
.PHONY: build
@@ -234,6 +236,11 @@ build-frontend: ## build the frontend container
@$(COMPOSE) build frontend-development $(cache)
.PHONY: build-frontend
build-mcp: cache ?=
build-mcp: ## build the mcp container
@$(COMPOSE) build mcp-development $(cache)
.PHONY: build-mcp
build-e2e: cache ?=
build-e2e: ## build the e2e container
@$(MAKE) build-backend cache=$(cache)
@@ -263,6 +270,7 @@ run-backend: ## Start only the backend application and all needed services
@$(COMPOSE) up --force-recreate -d celery-dev
@$(COMPOSE) up --force-recreate -d y-provider-development-converter
@$(COMPOSE) up --force-recreate -d yhub
@$(COMPOSE) up --force-recreate -d mcp-development
@$(COMPOSE) up --force-recreate -d nginx
.PHONY: run-backend