AI tools from your server (MCP)

import { createRemoteJWKSet, jwtVerify } from "jose";

const jwks = createRemoteJWKSet(new URL("https://api.salesive.com/api/v1/oauth/jwks"));

async function salesiveSession(req) {
  const token = (req.headers.authorization || "").replace(/^Bearer /, "");
  // Throws if the signature, algorithm, audience, issuer or expiry is wrong.
  const { payload } = await jwtVerify(token, jwks, {
    algorithms: ["ES256"],
    audience: process.env.SALESIVE_CLIENT_ID,
    issuer: "https://api.salesive.com",
    clockTolerance: 5,
  });
  if (payload.purpose !== "mcp") throw new Error("wrong purpose");
  return payload; // payload.shop is the store, payload.sub the merchant
}

import express from "express";
import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
import { z } from "zod";

const app = express();
app.use(express.json());

app.post("/mcp", async (req, res) => {
  let session;
  try {
    session = salesiveSession(req);
  } catch {
    return res.status(401).end();
  }

  const server = new McpServer({ name: "stock-sync", version: "1.0.0" });
  server.registerTool(
    "get_stock",
    {
      title: "Get stock",
      description: "Stock level for a SKU in this store's warehouse.",
      inputSchema: { sku: z.string() },
      annotations: { readOnlyHint: true },
    },
    async ({ sku }) => ({
      content: [{ type: "text", text: `SKU ${sku}: ${await stockFor(session.shop, sku)} units` }],
    }),
  );

  // Stateless: one transport per request.
  const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: undefined });
  res.on("close", () => transport.close());
  await server.connect(transport);
  await transport.handleRequest(req, res, req.body);
});

app.listen(3000);