Task Breakdown: MCP Server

Feature ID: mcp-server Status: Done (Retrospective; ongoing as new tools are whitelisted) Last updated: 2026-05-01

---

Phase 1 — Bootstrap

• T1. apps/mcp/ workspace package with NestJS scaffold.
• T2. MCP SDK integration with stdio transport.
• T3. streamable-http transport.

Phase 2 — OpenAPI ingestion

• T4. Fetch OpenAPI spec at boot from configured EVER_WORKS_API_URL.
• T5. Whitelist file at apps/mcp/src/openapi-tools/whitelist.ts.
• T6. Spec → MCP tool def converter.

Phase 3 — Auth + sanitisation

• T7. API key forwarding via x-api-key / Authorization.
• T8. HTTP-mode Authorization: Bearer requirement.
• T9. Response sanitiser stripping sensitive fields.
• T10. 2-minute call timeout.

Phase 4 — Tools (across releases)

• T11. Works (12), Generation (4), Items (4), Deployment (4), Plugins (5), Scheduling (4), Comparisons (5) — total 36.

Phase 5 — Deployment

• T12. Dockerfile under .deploy/docker/mcp/.
• T13. Compose service entry.

Phase 6 — Docs

• T14. User-facing doc docs/features/mcp-server.md.
• T15. Setup snippets for Claude Desktop / Claude Code.
• T16. Retrospective spec/plan/tasks.

Future work (open)

• SSE bridge for HTTP-mode streaming.
• Per-call AI key rotation.

Definition of Done

• All shipped tasks complete, tests pass, docs present, constitution gates verified.