mirror of
https://github.com/suitenumerique/docs.git
synced 2026-09-14 05:37:53 +02:00
Anthony LC
f9e30f1ccc
Add `src/frontend/servers/mcp`, a stateless TypeScript (Express + `@modelcontextprotocol/sdk`) MCP server exposing `search_documents`, `read_document` and `create_document` over Streamable HTTP. It is an OAuth resource server holding no credentials of its own: it verifies the caller's Keycloak token against the realm JWKS (`src/auth/jwtVerifier.ts`), checks the `docs-mcp` audience, then forwards the same token unchanged to Django's `/api/v1.0/mcp/documents/*` endpoints (`src/docsApiClient.ts`), which stays the sole authority on document permissions. No token exchange. Ship the `mcp-development` compose service, its `env.d/development/mcp` env file, a `build-mcp` Makefile helper, and `documentation/mcp_server.md` describing the full flow and how to connect MCP clients.
20 lines
889 B
Plaintext
20 lines
889 B
Plaintext
# docs-mcp: remote MCP server for Docs.
|
|
# See documentation/mcp_server.md.
|
|
|
|
MCP_HOST=0.0.0.0
|
|
MCP_PORT=4455
|
|
MCP_RESOURCE_URL=http://localhost:4455/mcp
|
|
|
|
# Keycloak: KEYCLOAK_ISSUER is the externally-visible issuer (used to validate the `iss` claim
|
|
# and in metadata); the *_URL vars are the network-reachable endpoints from inside Docker.
|
|
# This server only reads Keycloak's JWKS and discovery document — it holds no credentials and
|
|
# performs no token exchange; it forwards the caller's access token to Django as-is.
|
|
KEYCLOAK_ISSUER=http://localhost:8083/realms/impress
|
|
KEYCLOAK_JWKS_URL=http://nginx:8083/realms/impress/protocol/openid-connect/certs
|
|
KEYCLOAK_DISCOVERY_URL=http://nginx:8083/realms/impress/.well-known/openid-configuration
|
|
|
|
# Django is reached directly (not through nginx, which only proxies to Keycloak on :8083).
|
|
DOCS_API_URL=http://app-dev:8000
|
|
|
|
MCP_AUDIENCE=docs-mcp
|