@optare/mcp-server

A Model Context Protocol server for Optare — a first-class surface (Lane E · E8), not a demo. It lets an AI coding agent (Cursor, Claude Desktop, Antigravity, …) provision an Optare project and wire it into a codebase without a human opening the portal. This is the G1 wedge: agent-driven onboarding.

Tools

| Tool | What it does | |---|---| | optare_provision_app | Calls POST /api/mcp/bootstrap — creates a project + root organization and returns the pk_live_ / sk_live_ keys and the .env block. | | optare_get_integration_code | Returns copy-paste integration code for the detected framework (@optare/react for React/Next/Remix, @optare/client otherwise, @optare/node for the backend). |

Transports

optare-mcp          # stdio (default) — for Cursor / Claude Desktop
optare-mcp sse      # HTTP + SSE on $PORT (default 3000) — for hosted use

Configuration

| Env var | Required | Notes | |---|---|---| | MCP_SECRET | yes | Bearer token sent to POST /api/mcp/bootstrap. If unset, every bootstrap call is rejected (C23 — no "vibe-coder-secret" fallback). Compared with timingSafeEqual server-side. | | OPTARE_API_URL | no | Base URL of the Optare app. Defaults to the hosted origin. | | PORT | no | SSE mode only. |

The bootstrap endpoint is additionally rate-limited to 15 provisioning calls per hour per IP (H7), as defence in depth behind MCP_SECRET.

Client config example (Claude Desktop)

{
  "mcpServers": {
    "optare": {
      "command": "npx",
      "args": ["-y", "@optare/mcp-server"],
      "env": { "MCP_SECRET": "…", "OPTARE_API_URL": "https://id.optare.one" }
    }
  }
}

Contract

The POST /api/mcp/bootstrap request/response shape is defined once in @optare/contracts (mcpContract) and consumed here with @ts-rest/core's initClient. It also appears in the generated OpenAPI doc (GET /api/openapi.json).

Versioning

See docs/SDK_VERSIONING.md.