a73af353d4
- Streamable HTTP transport (MCP_TRANSPORT=http) with mandatory auth: static bearer tokens or OIDC resource-server mode (JWT via JWKS, or RFC 7662 introspection), RFC 9728 protected-resource metadata, and DNS-rebinding protection - secrets loadable from files via *_FILE variants - timeouts on all outbound requests; JORTT_READ_ONLY tool filtering - OpenAPI spec committed and bundled; no implicit network fetches - Nix flake: sandboxed package build + hardened NixOS module taking an EnvironmentFile (agenix-friendly) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
35 lines
1.1 KiB
Nix
35 lines
1.1 KiB
Nix
{
|
|
description = "MCP server for the Jortt accounting & invoicing API";
|
|
|
|
inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
|
|
|
|
outputs = { self, nixpkgs }:
|
|
let
|
|
systems = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" "aarch64-darwin" ];
|
|
forAllSystems = f: nixpkgs.lib.genAttrs systems (system: f nixpkgs.legacyPackages.${system});
|
|
mkPackage = pkgs: pkgs.callPackage ./nix/package.nix { };
|
|
in
|
|
{
|
|
packages = forAllSystems (pkgs: rec {
|
|
jortt-mcp = mkPackage pkgs;
|
|
default = jortt-mcp;
|
|
});
|
|
|
|
overlays.default = final: prev: {
|
|
jortt-mcp = mkPackage final;
|
|
};
|
|
|
|
nixosModules.jortt-mcp = { pkgs, lib, ... }: {
|
|
imports = [ ./nix/module.nix ];
|
|
services.jortt-mcp.package =
|
|
lib.mkDefault self.packages.${pkgs.stdenv.hostPlatform.system}.jortt-mcp;
|
|
};
|
|
nixosModules.default = self.nixosModules.jortt-mcp;
|
|
|
|
devShells = forAllSystems (pkgs: {
|
|
default = pkgs.mkShell {
|
|
packages = [ pkgs.nodejs_22 pkgs.typescript ];
|
|
};
|
|
});
|
|
};
|
|
}
|