Stack

• Runtime: Node.js 20+, TypeScript
• Framework: Hono
• Database: PostgreSQL via Prisma
• Cache: Redis
• Auth: JWT (JOSE) + Argon2 password hashing
• Billing: Stripe webhooks

Quickstart (local dev)

git clone <repo> ienox-mcp && cd ienox-mcp
cp .env.example .env     # fill in DATABASE_URL and secrets
npm install
npm run db:migrate       # run Prisma migrations
npm run dev              # starts on port 8000 with hot reload

Generate the required ENCRYPTION_KEY:

node -e "const {randomBytes}=require('crypto');console.log(randomBytes(32).toString('base64url'))"

Generate a strong IENOX_JWT_SECRET:

node -e "const {randomBytes}=require('crypto');console.log(randomBytes(32).toString('hex'))"

Scripts

npm run dev          # tsx watch — hot reload
npm run build        # tsc → dist/
npm run start        # node dist/index.js
npm run db:generate  # prisma generate (after schema changes)
npm run db:migrate   # prisma migrate deploy
npm run db:push      # prisma db push (dev schema sync)

API Overview

All protected routes require Authorization: Bearer <jwt>.

| Method | Path | Description | |--------|------|-------------| | GET | /health | DB + Redis health check | | POST | /auth/register | Create founder account | | POST | /auth/token | Login — returns JWT | | GET | /auth/me | Current founder (Authorization: Bearer or X-API-Key) | | POST | /auth/api-key | Issue MCP API key (first issue starts trial) | | POST | /auth/api-key/rotate | Rotate key (subscription required) | | POST | /auth/exchange | Exchange API key for JWT | | POST | /auth/mcp/pair/* | Device pairing for MCP clients | | POST | /stripe/webhook | Stripe billing events | | GET | /integrations | { connected, available } | | POST | /oauth/:integration/start | Start OAuth (google-calendar → google) | | GET | /oauth/:integration/status | Poll OAuth completion | | GET | /briefing | Latest cached Monday briefing | | POST | /briefing/generate | Generate Monday briefing (summary, sections) |

Configuration

All settings are read from environment variables (or .env):

| Variable | Purpose | |----------|---------| | DATABASE_URL | PostgreSQL connection string | | REDIS_URL | Redis connection (default: redis://localhost:6379/0) | | PORT | HTTP port (default: 8000) | | NODE_ENV | development or production | | IENOX_JWT_SECRET | Signs bearer tokens | | ENCRYPTION_KEY | Base64url-encoded 32-byte key — encrypts OAuth tokens at rest | | GITHUB_CLIENT_ID / _SECRET | GitHub OAuth app | | STRIPE_CLIENT_ID / _SECRET | Stripe Connect OAuth | | STRIPE_SECRET_KEY | Stripe API key | | STRIPE_WEBHOOK_SECRET | Stripe webhook signing secret | | STRIPE_CONNECT_WEBHOOK_SECRET | Stripe Connect webhook signing secret for founders' connected accounts | | LINEAR_CLIENT_ID / _SECRET | Linear OAuth app | | SLACK_CLIENT_ID / _SECRET | Slack OAuth app | | GOOGLE_CLIENT_ID / _SECRET | Google OAuth app (Calendar) | | NOTION_CLIENT_ID / _SECRET | Notion OAuth app |

In production, IENOX_JWT_SECRET must be at least 32 characters and ENCRYPTION_KEY must be a base64url value that decodes to exactly 32 bytes, or the server will refuse to start. Stripe webhook routes also fail closed unless their signing secrets are configured.

License

See LICENSE.