mcp

TianGong-LCA-MCP is a Model Context Protocol (MCP) server that exposes TianGong life-cycle assessment (LCA) capabilities to MCP-compatible AI hosts. It supports two transports: STDIO for local client integration and Streamable HTTP for remote use. Configuration is done through environment variables copied from `.env.example`, covering the Supabase issuer, publishable key, admitted public OAuth client IDs, and allowed browser origins. The README notes that OAuth authentication does not require Redis, a confidential client secret, or a server-side session encryption key. GLAD dataset search tools need an additional GLAD API key and base URL (defaulting to the public Global LCA Data Access endpoint). Remote Streamable HTTP is described as an OAuth 2.1 protected resource. A compatible MCP host discovers the protected-resource metadata, follows the Supabase Auth authorization server, opens the user's browser, and completes Authorization Code flow with S256 PKCE. Credentials are entered in the browser rather than into the AI or MCP host. Supabase issues access and rotating refresh tokens to the public MCP client; the client stores the refresh token locally and sends a short-lived ES256 access JWT with each request. The server verifies signature, issuer, audience, expiry, role/session, and exact client ID, with Edge/PostgREST re-verifying context and enforcing row-level security. Dynamic Client Registration is disabled; operators register exact public clients and loopback callbacks in Supabase and list their UUIDs in an allowlist variable. The MCP origin itself exposes no authorization, token, refresh, revoke, callback, registration, or demo endpoints. Installation and startup options include a global pnpm package (`@tiangong-lca/mcp-server`) run as a STDIO server via dotenv-cli, or a locally built Docker image published on port 9278 with an env file. Local testing uses pnpm scripts: `pnpm start` for the STDIO server through MCP Inspector, `pnpm start:server` for the Streamable HTTP server, and `pnpm start:server-local` for a local HTTP variant. The HTTP start commands launch MCP Inspector through a cross-platform Node argv wrapper. The README documents a pinned toolchain (Node 24.19.0, pnpm 11.24.0, TypeScript 7.0.2) and notes that the Docker examples describe a local build because no public prebuilt image tag is verified.