BaseLayer MCP Server (Phase 3)

A local, stdio-based MCP server. Runs on your own machine and uses your own GitHub, Vercel, Supabase, and Stripe credentials — nothing is transmitted or stored anywhere else.

Quickstart (for customers)

Nothing to clone or download by hand — npx fetches it automatically.

One-command setup:

npx -y baselayer-mcp init

This asks for your credentials, saves them locally, and automatically connects BaseLayer to your Claude app's config (macOS, Windows, and Linux paths are all handled, with a backup made of your existing config first). Nothing you type is sent anywhere except written to your own files. Fully quit and reopen your Claude app afterward, then just ask it to scaffold or audit a project.

Manual setup, if you'd rather do it by hand: make a folder to hold your credentials, create a .env file inside it (see the variable list below), then add this to your Claude config (Claude Desktop's claude_desktop_config.json, or Claude Code's .mcp.json/~/.claude.json):

{
  "mcpServers": {
    "baselayer": {
      "command": "npx",
      "args": ["-y", "baselayer-mcp"],
      "cwd": "/Users/you/your-baselayer-folder"
    }
  }
}

The cwd is how the server finds your .env file. If npx isn't found (common in GUI apps that don't inherit your shell's PATH), use the absolute path to your npx binary instead — find it by running which npx in a terminal.

Environment variables

1. Copy .env.example to .env and fill in:
   • SUPABASE_ACCESS_TOKEN — from supabase.com/dashboard/account/tokens
   • SUPABASE_ORG_ID — the org new projects should be created under
   • VERCEL_TOKEN — from vercel.com/account/tokens
   • VERCEL_TEAM_ID — only if you're on a Vercel Team account, otherwise leave blank
   • GITHUB_TOKEN — a fine-grained PAT with Contents (read/write) and Administration (read/write) permissions on all repositories
   • STRIPE_SECRET_KEY — your own Stripe secret key, used to create a product/price/webhook inside each scaffolded project
   • BASELAYER_LICENSE_KEY — your BaseLayer subscription's Stripe Subscription ID (shown on the success page after subscribing)
2. npm install

Tools

• scaffold_project — requires an active BaseLayer license. Takes a project name and:

  1. Creates a new Supabase project with a starter schema
  2. Pushes a minimal Next.js starter to a new private GitHub repo
  3. Deploys it to Vercel
  4. Creates a Stripe product/price and a signature-verified webhook endpoint in the deployed app

  The starter template includes secure defaults out of the box: a .gitignore covering .env, an in-memory rate limiter (lib/rateLimit.js) with an example route using it, the signature-verified Stripe webhook, and starter Privacy Policy / Terms of Service pages — so freshly scaffolded projects pass audit_project from day one.

• audit_project — requires an active BaseLayer license. Takes a local project directory and checks it against ~14 rules across three categories:

  1. Security — no committed secrets, no hardcoded keys, no known-vulnerable dependencies, API input validation, webhook signature verification, no dangerous code patterns
  2. Abuse prevention — rate limiting present, usage limits enforced server-side (not just in the UI), mutating routes require auth, no wide-open CORS
  3. Legal — a real (non-placeholder) Privacy Policy and Terms of Service exist

  Reports in plain language: what's missing, why it matters, and whether it can be fixed automatically. Pass applyFixes: true to actually apply the safe fixes (new files only — appending to .gitignore, untracking an already-committed .env via git rm --cached, generating missing legal pages — it never rewrites existing application code, and it doesn't rewrite git history, so a leaked secret should still be rotated even after the fix runs).

Licensing

scaffold_project calls the hosted license API (/Users/ethan/baselayer-license-api, deployed separately at baselayer-license-api.vercel.app) before doing anything else. That API checks your BASELAYER_LICENSE_KEY (a Stripe Subscription ID) against BaseLayer's own Stripe account — a live lookup, no separate database. If the subscription isn't active, scaffolding is refused with a clear error.

Running it directly

npm start

This starts the MCP server on stdio — it's meant to be launched by an MCP client (Claude Desktop, Claude Code), not run standalone in a terminal you watch.

Connecting to Claude Desktop (working on this repo directly)

If you're developing against a local checkout rather than the published package, point Claude at this folder instead of using npx:

{
  "mcpServers": {
    "baselayer": {
      "command": "npm",
      "args": ["start"],
      "cwd": "/Users/ethan/baselayer-server"
    }
  }
}

Restart Claude Desktop, then ask it to scaffold a project.

Testing without an MCP client

npm run test:scaffold -- my-test-project

Runs scaffold_project directly and prints the results — useful for verifying credentials/API behavior without going through an MCP client.

npm run test:audit -- /path/to/project [--fix]

Runs audit_project directly against a local directory.